[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAAfJHtqy8hp6imxP=S+98RDJ=5YR0a8sN3hdTMtp8SotT7BBJA@mail.gmail.com>
Date: Wed, 14 Feb 2024 15:56:15 +0000
From: Mate Kukri <mate.kukri@...onical.com>
To: corsac@...ian.org, oss-security@...ts.openwall.com
Subject: Re: Secure Boot bypass in EDK2 based Virtual Machine firmware
In the case of these OVMF/AAVMF images I believe the only other
built-in application accessible is the firmware setup utility and boot
selector.
These obviously provide many capabilities, but require a user present
at the console to access, and to the best of my knowledge not
vulnerable to this attack.
For firmware images provided by other vendors or distributors, I have no idea.
On Wed, Feb 14, 2024 at 3:52 PM Yves-Alexis Perez <corsac@...ian.org> wrote:
>
> On Wed, Feb 14, 2024 at 03:47:23PM +0000, Mate Kukri wrote:
> > That is correct in the general case, but here the issue comes from the
> > fact that a copy of the Shell was included in the firmware image
> > itself, and as a built-in application was implicitly trusted.
>
> Ah, thanks for the clarification, I didn't know about the implicit trust
> on "built-in applications". Out of curiosity, are there other such
> applications, which could be abused?
>
> Regards,
> --
> Yves-Alexis Perez
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
