A security vulnerability in the Microsoft Windows Recovery Environment (WinRE) allows attackers to bypass administrator-configured UEFI or BIOS passwords on GIGABYTE motherboards. Tracked as VU#226679, the issue stems from an unauthenticated UEFI BootNext variable that permits unauthorized reboots via external media, effectively undermining firmware-level security controls.
How the WinRE Bypass Works
The security flaw relies on the UEFI BootNext variable, a setting used to dictate the next boot device. According to the CERT Coordination Center (CERT/CC), WinRE can trigger a reboot process that fails to enforce the same authentication checks typically required during a standard startup. Because the UEFI specification does not mandate authentication for the BootNext variable, an attacker with physical access or sufficient system privileges can force a machine to boot from an external device, bypassing the UEFI administrator password entirely.
The “Evil Maid” attack scenario describes a situation where an adversary gains temporary physical access to an unattended device to install malicious firmware or bypass security, often leaving no obvious signs of tampering.
Why GIGABYTE Labels the Behavior “By Design”
While CERT/CC classifies this as a security concern for organizations, GIGABYTE maintains that the behavior is an intentional design choice. In a security advisory, the hardware manufacturer stated that its firmware is intended to trust BootNext requests that originate from a “trusted” operating system environment. GIGABYTE argues that this is a trade-off inherent in the current UEFI trust model rather than a firmware defect. Consequently, the company has not announced plans for a firmware patch, instead directing users toward operational security practices.
How to Protect Your Hardware
Because there is no immediate firmware update to resolve this, security professionals must rely on layered defenses. CERT/CC and GIGABYTE both recommend the following strategies to mitigate unauthorized access:
- Enable BitLocker: Use full-disk encryption paired with a TPM+PIN configuration to ensure data remains inaccessible even if a system boots from an external drive.
- Restrict Recovery Access: Use Group Policy to limit access to WinRE and Advanced Startup options for standard users.
- Control Boot Media: Disable booting from USB or external drives within the BIOS/UEFI settings if those features are not required for daily operations.
- Physical Security: Limit physical access to hardware, particularly in environments where machines are left unattended for long periods.