GRUB2 (shim_lock verifier): The shim_lock verifier let non-kernel files through, so an attacker could get unsigned

Impact

The shim_lock verifier let non-kernel files through, so an attacker could get unsigned content loaded into the boot path while Secure Boot enforcement appeared intact. It defeats the exact control operators rely on to promise a clean handoff between bare-metal tenants.

Who can reach it

Local, with the ability to place a file GRUB will load.

What to do

grub2 package update + reboot. This is one where the dbx revocation genuinely matters - without it the old signed GRUB remains a usable bypass tool that an attacker can simply drop onto a patched node.

References

Related entries

• shim (handle_image PE loader): Buffer overflow in shim's own image loaderCVE-2022-28737 · shim (handle_image PE loader)High
• Insyde InsydeH2O (UsbCoreDxe, untrusted pointer use): UsbCoreDxe uses pointers it was handed without establishing theyCVE-2022-29275 · Insyde InsydeH2O (UsbCoreDxe, untrusted pointer use)High
• Insyde InsydeH2O (AhciBusDxe, untrusted SMI inputs): SMI functions in the AHCI/SATA driver consume untrusted inputsCVE-2022-29276 · Insyde InsydeH2O (AhciBusDxe, untrusted SMI inputs)High
• Insyde InsydeH2O (NvmExpressDxe, incorrect pointer checks): The NVMe driver's pointer validation is wrong, allowingCVE-2022-29278 · Insyde InsydeH2O (NvmExpressDxe, incorrect pointer checks)High
• Insyde InsydeH2O (SdHostDriver and SdMmcDevice, untrusted pointer use): One advisory covering both SD layers: untrustedCVE-2022-29279 · Insyde InsydeH2O (SdHostDriver and SdMmcDevice, untrusted pointer use)High
• Insyde InsydeH2O (PnpSmm initialization, SMRAM corruption via later PNP SMIs): An initialization-order defect: PnpSmm'sCVE-2022-30771 · Insyde InsydeH2O (PnpSmm initialization, SMRAM corruption via later PNP SMIs)High