UEFI Shell Flaws Let Hackers Disable Secure Boot on Over 200,000 Laptops
Security researchers have identified critical vulnerabilities in signed UEFI shells that can allow attackers to bypass Secure Boot protections on approximately 200,000 Framework laptops and desktops.
Security researchers have identified critical vulnerabilities in signed UEFI shells that can allow attackers to bypass Secure Boot protections on approximately 200,000 Framework laptops and desktops.
The vulnerabilities involve legitimate diagnostic tools signed with trusted Microsoft certificates. These UEFI shells, while intended for system administration and firmware development, contain functionalities that can disable core security protections.
Description Impact Affected Systems
Signed third-party UEFI bootloaders vulnerable to Secure Boot bypass Secure Boot bypass through signed bootloaders Systems with vulnerable Microsoft-signed UEFI bootloaders
Insecure UEFI Shell in EDK2 left enabled in Ubuntu's EDK2 Secure Boot bypass via UEFI Shell Ubuntu systems using EDK2
The vulnerabilities involve legitimate diagnostic tools signed with trusted Microsoft certificates.
Vulnerable bootloaders in system recovery tools enable Secure Boot bypass Secure Boot bypass, ransomware installation Systems with vulnerable signed recovery tool bootloaders
The core issue lies in the mm command in many UEFI shells, allowing direct read and write access to system memory. Attackers can modify critical security structures before the operating system loads.
Attackers can target the Security Architectural Protocol to overwrite memory locations that verify digital signatures during boot. This effectively neutralizes Secure Boot while the system reports that protections are active.
Using UEFI shell commands, attackers locate the memory address of the security handler and overwrite it, disabling signature verification for subsequent module loads.
Qemu to launch the UEFI shell and automatically try to run the "mm" command
Keep UEFI revocation lists updated through DBX updates to blacklist vulnerable bootloaders. Implement BIOS password protection. Deploy custom Secure Boot key management. Use firmware analysis tools to identify vulnerable components.
Organizations must prioritize firmware security, as attackers at this level can bypass most security controls in operating systems and applications.
Based on reporting by GBHackers.