GNU GRUB 2.14: serial-MMIO lockdown bypass in Canonical-signed gcdx64.efi
Canonical-signed GRUB2 serial command accepts arbitrary MMIO addresses, letting local attackers with grub.cfg control bypass Secure Boot lockdown.
A vulnerability in Canonical's grub-efi-amd64-signed (gcdx64.efi, GRUB 2.14) exposes a serial command that accepts a caller-supplied 64-bit MMIO base address. The lockdown path does not restrict this command even when lockdown=y under UEFI Secure Boot, and the serial implementation does not validate that the requested register span belongs to a real UART rather than ordinary RAM. A local attacker with control of GRUB's boot configuration can abuse this to bypass the Secure Boot lockdown.
- Serial command accepts arbitrary caller-supplied 64-bit MMIO base addresses
- Lockdown path fails to restrict the command even when lockdown=y
- No validation that the MMIO span maps to a real UART instead of RAM
- Affects Canonical-signed gcdx64.efi admitted by UEFI Secure Boot
- Requires local attacker with control of GRUB boot configuration
From the original article
Posted by Luppa on Sep 13 == Overview == Canonical-signed GRUB2 (grub-efi-amd64-signed), when admitted by UEFI Secure Boot and reporting lockdown=y, exposes a serial command that accepts a caller-supplied 64-bit MMIO base address. The lockdown path does not restrict this command, and the serial implementation does not validate that the requested register span belongs to a real UART rather than ordinary RAM.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.