3 ms·

So this says it impacts Windows, but it seems to only be an issue with grub?

• efreak 6y ago
  There are only two references to Windows in the article. The first one says Microsoft might push an update to the UEFI revocation list blacklisting the vulnerable binaries. The second mentions that dual-boot systems are affected, basically a reminder that if you're dual-booting with SecureBoot enabled, you need to make sure you've got the new non-vulnerable binaries installed on Linux before any updates to the revocation list (applied in the previously-mentioned possible Windows update) prevent you from booting it.
  • SAI_Peregrinus 6y ago
    And that if the attacker has admin and physical access to Windows they can just install GRUB from there, then exploit that to install a rootkit to persist their access.
    • usr1106 6y ago
      Do you really need physical access for that? Grub is not signed by Microsoft CA, only shims are. So the exploit is installing an old shim and a vulnerable grub.