A critical vulnerability affecting Linux systems has been discovered, allowing attackers to bypass Secure Boot protections and potentially gain control over computers. The issue lies in 11 outdated Microsoft-signed UEFI shims that can be exploited by malicious actors. These vulnerable components are no longer supported by Microsoft but remain installed on some Linux distributions.
The problem arises from the fact that these outdated UEFI shims, signed by Microsoft, can be used to bypass Secure Boot’s primary function: ensuring only authorized operating systems and firmware are loaded during startup. This security feature is designed to prevent malware and unauthorized software from being launched during boot. However, if an attacker gains control over a system with one of the vulnerable shims installed, they could potentially exploit this vulnerability to install malicious code or modify the system’s firmware.
The 11 affected UEFI shims were created between 2008 and 2013 by Microsoft as part of its Unified Extensible Firmware Interface (UEFI) development efforts. Although these components have long been superseded by newer versions, some Linux distributions still include them in their repositories. If an attacker finds a system running one of the vulnerable shims, they can exploit this vulnerability to bypass Secure Boot’s protection and gain access to the system.
The exploitation process involves using a combination of social engineering tactics and technical expertise to convince a user or administrator into installing a malicious shim that appears legitimate. Once installed, the attacker can use the shim to modify the system’s firmware, allowing them to bypass Secure Boot protections and install unauthorized software. This could potentially lead to significant security breaches, as an attacker with access to a compromised system could exploit other vulnerabilities or install malware.
The fact that these outdated UEFI shims remain installed on some Linux distributions highlights the importance of maintaining up-to-date systems and dependencies. Users are advised to review their system’s package list for any outdated components and update them promptly. Additionally, administrators should ensure that their systems only load authorized firmware during startup by regularly scanning for suspicious or unauthorized software.
To minimize this risk, users can take a few precautions: first, keep all installed packages up-to-date; second, regularly scan the system for potential security threats; third, review the system’s package list for any outdated components.
Source: The Hacker News — 2026-07-14