Microsoft Surface Security Feature Bypass Vulnerability

A security feature bypass vulnerability has been identified in various Microsoft Surface devices, including the Surface Pro 9 ARM, Surface Pro 8, Surface Laptop Go, Surface Go 2, Surface Hub 3, Surface Laptop 3 with Intel Processor, Surface Hub 2S, Surface Pro 7+, Surface Laptop 4 with AMD Processor, Surface Laptop Go 3, Surface Go 3, Surface Laptop Go 2, Surface Laptop 4 with Intel Processor, and Surface Windows Dev Kit. This vulnerability allows for a bypass of security features related to the hypervisor, which could potentially compromise the secure kernel and hypervisor on certain hardware by bypassing the Unified Extensible Firmware Interface (UEFI). The vulnerability requires user interaction, specifically a reboot, and can be exploited by gaining access to the restricted network where the affected device is located.

Impact

Exploitation of this vulnerability could lead to a bypass of security features, allowing for potential manipulation or compromise of the hypervisor and secure kernel on affected devices.

Remediation

Surface devices receive updates through Windows Update. For manual installation, check the update status in the Surface app or refer to the Surface update history for guidance.