3 ms·
No, revocation lists can be updated from the OS and are freely available from https://uefi.org/revocationlistfile https://uefi.org/revocationlistfile
by mjg59 4y ago
No, revocation lists can be updated from the OS and are freely available from https://uefi.org/revocationlistfile https://uefi.org/revocationlistfile
- megous 4y agoSo the OS just doesn't do it automatically?
- skozharinov 4y agoIt does. Windows ships them as part of security updates, Linux distributions can use fwupd.
- mjg59 4y agoAs noted in the other comment, Linux (if running fwupd) and Windows support doing it automatically, but the files are made public so other operating systems and distributions can also implement that.
- megous 4y agoI find it hard to square with: "In this blogpost we present the first public analysis of this UEFI bootkit, which is capable of running on even fully-up-to-date Windows 11 systems with UEFI Secure Boot enabled."
- mjg59 4y agoMicrosoft has not yet chosen to revoke the vulnerable bootloader
- akira2501 4y agoIt already has 234 entries, all issued within a year of each other. How much space does a UEFI BIOS typically allocate for this list? Are you able to use this mechanism to revoke good BIOS signatures, is there an availability issue potentially created by misuse?
- mjg59 4y agoA new mechanism called SBAT (https://github.com/rhboot/shim/blob/main/SBAT.md https://github.com/rhboot/shim/blob/main/SBAT.md) is now used to allow revocation of groups of bootloaders rather than individual hashes in order to mitigate the resource consumption