11 Old Microsoft-Signed Linux UEFI Bootloaders Found That Allow Secure Boot Bypass

Cybersecurity researchers have discovered 11 old Microsoft-signed UEFI applications (shims) that can be used to bypass the Secure Boot mechanism on most systems running the modern UEFI firmware standard.

The heart of the problem

Secure Boot is designed to ensure that only trusted, cryptographically signed code runs while a computer boots, preventing malware from launching before the operating system starts. The vulnerable shims uncovered by the researchers were originally meant to boot Linux distributions, but they contain flaws that make it possible to circumvent this protection.

According to the specialists, an attacker who exploits one of these vulnerable applications can execute untrusted code during the system's boot phase. This opens the door to deploying malicious UEFI bootkits or other malware that operates at the very earliest stage of a device's operation — before the operating system and antivirus solutions start.

Why this is dangerous

Because the bootloaders are signed with a legitimate Microsoft certificate, they are inherently considered trusted within the Secure Boot chain. This makes it possible to bypass the authenticity check built into the protection technology itself and run arbitrary code before the operating system kernel is even loaded.

Bootkits installed this way are extremely difficult to detect and remove with standard security tools, because they operate at a level below the operating system and can survive a reinstall of it.

What comes next

The issue affects most systems that use the modern UEFI standard with Secure Boot enabled. Details about the specific mechanisms for remediating the vulnerability are not provided in the information available.

Source: The Hacker News