2 ms·

CVE-2018-12169: Platform sample code firmware included with Haswell, Broadwell, Skylake, Kaby Lake, Coffee Lake and Cannon Lake processors contains a logic erro

CVE-2018-12169: Platform sample code firmware included with Haswell, Broadwell, Skylake, Kaby Lake, Coffee Lake and Cannon Lake processors contains a logic error allowing a physical attacker to bypass BootGuard firmware authentication. https://edk2-docs.gitbooks.io/security-advisory/content/unauthenticated-firmware-chain-of-trust-bypass.html https://edk2-docs.gitbooks.io/security-advisory/content/unau... "also potentially allows a developer to "jailbreak" their BootGuard protected laptop since the UEFI DXE volume can be replaced with a user provided LinuxBoot ROM image": https://twitter.com/qrs/status/1044157473882591233 https://twitter.com/qrs/status/1044157473882591233

oneplane 8y ago
Well, LinuxBoot is more like heads (the kernel based pre-boot environment), which was possible for a while now (because the DXE was often not required to be signed for BootGuard to be happy). If we could do coreboot with only the FSP as blob, that would be cool. We'd still have the ME glued in tho, so not complete free booting there yet. Also, sadly, most firmwares out there don't have that 1:1 edk2 code in their firmware.