A group of nearly a dozen forgotten UEFI shim bootloaders, which had been trusted for years by Secure Boot-enabled systems, has recently come to light as a potential blind spot in our security defenses. These old bootloaders, which were created to facilitate the boot process on Linux systems with Secure Boot enabled, contained vulnerabilities that could have allowed attackers to bypass Secure Boot protections and execute malicious code at boot time.
Researchers from ESET discovered 11 vulnerable UEFI shim bootloaders that remained trusted by Microsoft’s third-party UEFI signing certificate. These bootloaders were version 0.9 or earlier, which is several generations behind the current versions. What’s alarming is that despite their known vulnerabilities, these old shims continued to be trusted components in the Secure Boot chain.
The Unified Extensible Firmware Interface (UEFI) is a type of motherboard software that connects the operating system and hardware. It consists of multiple layers, including the firmware, the bootloader, and the operating system. UEFI shim bootloaders act as a bridge between the firmware and the operating system bootloader, allowing Linux distributions to boot on Secure Boot-enabled systems.
The ESET researchers found that these vulnerable shims either launched second-stage bootloaders with known flaws or lacked security protections available in newer versions. In some cases, they even contained vulnerabilities that could allow attackers to bypass Secure Boot protections. This meant that an attacker only needed a copy of one of these old bootloaders and a basic understanding of how Secure Boot works to bypass the secure startup process.
Microsoft has since revoked the vulnerable bootloaders through Secure Boot revocation updates in June, but systems that haven’t been updated may still trust these components. According to ESET, an attacker could introduce the old shim into any machine still trusting the Microsoft Corporation UEFI CA 2011, regardless of the installed operating system.
The discovery highlights a challenge in preventing old and vulnerable software from remaining trusted components in the Secure Boot chain long after they can no longer be relied upon. “This is not merely a flaw in 11 obscure products,” says Jason Soroko, senior fellow at Sectigo. “It is a failure to retire trust.” Microsoft’s signature turned old shims into portable, bring-your-own boot components that an attacker could introduce into any machine still trusting the Microsoft Corporation UEFI CA 2011.
While Microsoft’s revocations have addressed the issue for systems with updated Secure Boot deny lists, older shims signed before 2017 may pose a challenge in identifying and revoking every vulnerable component. “The broader lesson is that signed boot code can become long-lived ‘Secure Boot debt’ when inventory and revocation lag behind software retirement,” says Soroko.
So what does this mean for you? If your system is still running on an older version of Secure Boot, it’s essential to update your firmware and ensure that all bootloaders are up-to-date. Additionally, be cautious of any third-party bootloaders or software that may be introduced into your system. Remember, a trusted component can become a liability if not properly managed. Stay vigilant and keep your systems updated to avoid falling victim to these types of attacks.
Source: Dark Reading — 2026-07-15