# Signed driver trust bypass via check-use swap

Signature or allowlist verdict applied to bytes or identity that changed after the check

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2026-07-14. Updated 2026-10-23._

## How it works
A loader or security component verifies a signature, catalog, or allowlist entry, then consumes the object later. The broken assumption is that the verified object is the same one used. If the backing file can be rewritten, the mapping re-read, or the name reused between check and use, the trusted verdict lands on untrusted content. The check and the use must be bound to the same immutable bytes or identity.

## Where it shows up
- Files opened for integrity checks without denying writers (no FILE_SHARE_WRITE), or mapped as plain data sections with no page hashes [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-false-file-immutability.md)
- Paths reachable through network redirectors or other servers that need not honor local share modes [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-false-file-immutability.md)
- Signed first-stage loaders that delegate trust to embedded certs and second-stage binaries [E3](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-forgotten-uefi-shims-undermining-secure-boot.md)
- Revocation checks that compare the wrong length or field, so the comparison reads bogus data [E3](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-forgotten-uefi-shims-undermining-secure-boot.md)
- Signed drivers whose image is trusted but whose loaded bytes or signer are not re-confirmed at use [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker.md)

## How to review
Trace every trust decision to its point of use. The invariant: the bytes or identity verified are exactly the bytes or identity consumed, with no window for substitution. Confirm files are opened denying write and delete, that mappings used for verification are not re-read from a mutable source, and that delegated trust (embedded certs, second stages) is revalidated against current revocation and denylists [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-false-file-immutability.md)[E3](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-forgotten-uefi-shims-undermining-secure-boot.md). For drivers, confirm the loaded image matches the expected signer and that revocation is actually enforced, not just recorded [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker.md)[E3](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-forgotten-uefi-shims-undermining-secure-boot.md).

## Variants seen
- Catalog swapped mid-parse over a network redirector after signature check [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-false-file-immutability.md)
- Malicious driver signed with a revoked certificate, impersonating a security vendor [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker.md)
- Old signed UEFI shims lacking denylist/SBAT enforcement, trusting vulnerable second stages [E3](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-forgotten-uefi-shims-undermining-secure-boot.md)
- Signature-length mismatch causing revocation checks to compare bogus data [E3](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-forgotten-uefi-shims-undermining-secure-boot.md)

## Why fixes fail
Shims without denylist enforcement stayed trusted for years [E3](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-forgotten-uefi-shims-undermining-secure-boot.md); revocation alone did not stop a revoked-cert driver from loading [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker.md); relying on share-mode denial for immutability failed against redirectors [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-false-file-immutability.md).

## Impact and severity
Unsigned kernel drivers loaded, Secure Boot bypassed, EDR/AV disabled, ransomware deployed [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-false-file-immutability.md)[E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker.md)[E3](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-forgotten-uefi-shims-undermining-secure-boot.md). Severity is high: kernel or pre-boot trust. Worse when the trusted component is a security product or the check is a single point reused everywhere.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-false-file-immutability.md
- E2: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker.md
- E3: https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-forgotten-uefi-shims-undermining-secure-boot.md