Linus Tech Tips Discussion

 Firmware vulnerability allowing for secure boot bypass exploit affects 200K+ Framework Laptops Summary Over 200K+ Framework Laptops are susceptible to Secure Boot bypass exploit due to oversight in signed UEFI shells that would allow bad actors to load bootkits that can evade OS-level security controls and persist across OS re-installs. This issue was discovered by firmware security research company Eclypsium, and they already issued a warning to Framework. Framework are yet to comment on the subject but it seems that the patch will arrive in the next BIOS update.   Quotes Quote According to firmware security company Eclypsium, the problem stems from including a 'memory modify' (mm) command in legitimately signed UEFI shells that Framework shipped with its systems. The command provides direct read/write access to system memory and is intended for low-level diagnostics and firmware debugging. However, it can also be leveraged to break the Secure Boot trust chain by targeting the gSecurity2 variable, a critical component in the process of verifying the signatures of UEFI modules. The mm command can be abused to overwrite gSecurity2 with NULL, effectively disabling signature verification.   [...] Eclypsium researchers estimates that the problem has impacted roughly 200,000 Framework computers (BleepingComputer)   Quote   UEFI shells act as pre-boot command-line environments, akin to a supercharged terminal with unrestricted hardware access. Designed for IT pros to diagnose hardware, update firmware, configure settings, or test drivers, they run before the OS loads, granting privileges far beyond typical admin rights. The problem arises from their integration into the Secure Boot chain of trust. Microsoft’s UEFI Certificate Authority serves as the root anchor, signing third-party tools that original equipment manufacturers (OEMs) embed in firmware. Once signed, these shells execute without scrutiny, even on systems enforcing Secure Boot to block unsigned code.   Eclypsium’s deep dive revealed that many such shells harbor the “mm” command for memory modification. This tool lets users read or write to any system memory address, bypassing protections like address space layout randomization or data execution prevention features absent in the pre-OS world.   [...] Affected models span Framework’s lineup, from 11th Gen Intel Core to AMD Ryzen AI series, impacting roughly 200,000 units. Framework has rolled out fixes by stripping risky commands from shells and updating DBX revocation lists to blacklist vulnerable versions. Users can apply BIOS updates or delete Framework DB keys via setup menus for immediate protection.  (CSN)   My thoug