3 ms·
> When you tell shim what EFI binary to boot, you can specify it as an HTTP URL. If you do this and the HTTP server is malicious, it can trigger an out-of-bound
by RcouF1uZ4gsC 3y ago
> When you tell shim what EFI binary to boot, you can specify it as an HTTP URL. If you do this and the HTTP server is malicious, it can trigger an out-of-bounds write.
Can a malicious server just send a compromised binary directly?
- smileybarry 3y agoNo, because that binary is still sigchecked against the locally-accepted keys (MOK). But an out-of-bounds write can be abused to bypass that.