21D ago
2 sources
Eclypsium found that Framework laptops shipped a legitimately signed UEFI shell with a 'memory modify' command that lets attackers zero out a key pointer (gSecurity2) and disable signature checks. Because the shell is trusted, this breaks Secure Boot’s chain of trust and enables persistent bootkits like BlackLotus.
— It shows how manufacturer‑approved firmware utilities can silently undermine platform security, raising policy questions about OEM QA, revocation (DBX) distribution, and supply‑chain assurance.
Sources: Secure Boot Bypass Risk Threatens Nearly 200,000 Linux Framework Laptops, Logitech Caused Its Mice To Freak Out By Not Renewing a Certificate