Critical vulnerability affecting most Linux distros allows for bootkits

Comments

• Static_Rocket@lemmy.world ⁨9⁩ ⁨months⁩ ago

  The most useful quote to those familiar with the linux boot process:

  “An attacker would need to be able to coerce a system into booting from HTTP if it’s not already doing so, and either be in a position to run the HTTP server in question or MITM traffic to it,” Matthew Garrett, a security developer and one of the original shim authors, wrote in an online interview. “An attacker (physically present or who has already compromised root on the system) could use this to subvert secure boot (add a new boot entry to a server they control, compromise shim, execute arbitrary code).”

  source

  • ShittyBeatlesFCPres@lemmy.world ⁨9⁩ ⁨months⁩ ago

    I only let attackers with root privileges execute arbitrary code on my guest WiFi so I’m good.

    source
• LinusWorks4Mo@kbin.social ⁨9⁩ ⁨months⁩ ago

  clickbait title. basically, if your machine is already compromised in a severe way, here is another way how to compromise it further (for whatever reason)

  source
• Zip2@feddit.uk ⁨9⁩ ⁨months⁩ ago

  Just uninstall it and install Windows instead.

  source

  • KairuByte@lemmy.dbzer0.com ⁨9⁩ ⁨months⁩ ago

    I for one appreciate the switcheroo, and can only imagine “being butthurt” as the reason you got downvoted.

    source
• Kalkaline@leminal.space ⁨9⁩ ⁨months⁩ ago

  I don’t know that I’ve actually heard of a Linux vulnerability before, but especially not this bad. It was a good streak and I’m sure it will be patched quickly.

  source

  • cmnybo@discuss.tchncs.de ⁨9⁩ ⁨months⁩ ago

    It’s not even a Linux vulnerability, it’s an issue with the UEFI shim.

    source

    • Kalkaline@leminal.space ⁨9⁩ ⁨months⁩ ago

      I guess I’ve still never heard of a major Linux vulnerability then.

      source

      • -> View More Comments
  • geekworking@lemmy.world ⁨9⁩ ⁨months⁩ ago

    This flaw is not really that bad because it requires the attacker to already have total and complete control over the system already. For example, if they were able to steal the root password.

    This flaw just makes it easier for the attacker to hide and harder to evict them.

    source
• interdimensionalmeme@lemmy.ml ⁨9⁩ ⁨months⁩ ago

  Can I use it to root my unlockable boot loader android 9 phone ?

  source