A critical vulnerability in CPSD CryptoPro Secure Disk for Bitlocker allows attackers to bypass file integrity checks by failing to properly validate LUKS encryption during the boot process.

The vulnerability resides in the bootxsa.efi component, which fails to correctly validate the presence of LUKS encryption. This logic error results in the bypass of critical file integrity checks when encryption is detected, which can be triggered by an unauthenticated attacker.

The exploitation of this flaw allows for the circumvention of security controls designed to protect disk integrity. Given the CVSS score of 7.5, this represents a high-severity risk that could lead to unauthorized data access or the persistent compromise of system integrity. Organizations relying on this software for full-disk encryption should treat this as a significant threat to data confidentiality.

Immediate Action: Update CPSD CryptoPro Secure Disk for Bitlocker to version 7.7.4 or later immediately.

Proactive Monitoring: Monitor system boot logs and integrity audit trails for any anomalous behavior or unexpected bypass events during the initialization phase.

Compensating Controls: Ensure that physical access to the hardware is strictly controlled to prevent unauthorized modification of the boot environment, as this is a prerequisite for exploiting boot-level vulnerabilities.

Public Exploit Available: No

The vulnerability in the boot process poses a substantial risk to the security posture of endpoints utilizing CryptoPro Secure Disk. Administrators must prioritize the deployment of the 7.7.4 patch to restore proper integrity validation. Failure to remediate this issue leaves systems susceptible to unauthorized tampering at the boot level, which is difficult to detect once the operating system has loaded.