[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]
> Here's the report from the original researchers who found and published it: > https://eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/ > For details on vulnerabilities if you want to follow them up check the > official databases for details: > https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-10713 > https://www.kb.cert.org/vuls/id/174059 > Usually there'll be links to the original source and as much follow up > information as you can use there - if you're really lucky even a functional > PoC (or wait for metasploit to provide a module). As I said, I did read the report you linked to - but even in the two further links you shared I could not find the name of the 'sole GRUB vendor' who had gone to the trouble of signing the GRUB config file. > Secure Boot is a subset of UEFI but not critical so don't let it hold you > back - the vast majority of modern-ish PCs support dual BIOS/UEFI firmware > stacks which you can toggle between at will so you probably already have the > capability on your computer(s) already. I made a note of the BIOS copyright date when turning on my PC this morning: July 2008. I believe this predates widespread adoption of UEFI by a few years. > Agreed the Microsoft CA bit is a little sketchy - maybe you're too > young to remember all the bitter fighting about it when UEFI was first > introduced? I certainly remember the criticism of Secure Boot, and that it would compromise the consumers' right to install their own operating system. As for the bitter fighting, well, clearly Microsoft won in this case. According to various sources UEFI supports more than four primary partitions on a single drive. When I eventually acquire a UEFI PC do not expect to see me for a few weeks as I savour the pleasure of installing Linux distributions without restriction...! :D Best wishes, Sebastian Freenode: 'seabass' -- The Mailing List for the Devon & Cornwall LUG https://mailman.dcglug.org.uk/listinfo/list FAQ: http://www.dcglug.org.uk/listfaq