June 1

Saint Dubious Disk, the Ramdisk That Was Never Created

Patron of boot managers, BitLocker keys sealed by the TPM alone, and flags nobody checks.

Life

Revealed in 2024 by Rairii (wack0) in a write-up that opens like a Poe poem, he was born of a forgotten bit. In the Windows BCD a ramdisk marked "to be created" is filled in at boot; clear that bit and the boot environment trusted the physical address and size written by the attacker, turning every disk write into an arbitrary memory write. Secure Boot fell, and BitLocker keys could be dumped in the default setup; Microsoft patched it in instalments, under a string of CVEs.

Prayer

O Saint Dubious Disk, who writes where nobody looks, let our boot managers check every bit before trusting it. Amen.

How to celebrate

Celebrated by installing the Secure Boot updates, revoking vulnerable boot managers and adding a PIN to BitLocker.

Dubious disk, risky boot.