Secure Boot’s Hidden Weakness: Old Linux Shims Still Signed by Microsoft
For years, Secure Boot has been a cornerstone of modern PC security. The idea is simple: only code signed by a trusted authority—like Microsoft—can run during the boot process. But a newly disclosed vulnerability throws a wrench in that logic. Cybersecurity researchers have identified 11 old, Microsoft-signed Unified Extensible Firmware Interface (UEFI) applications that can be weaponized to bypass Secure Boot on most systems using the modern firmware standard.
These aren’t obscure pieces of code. They’re Linux boot shims—small programs designed to bridge the gap between a UEFI firmware and a Linux bootloader. The problem? They’re ancient, and they’re still carrying Microsoft’s cryptographic blessing.
How an Old Shim Becomes a Backdoor
The attack chain is deceptively straightforward. An attacker with physical access or remote code execution on a target machine can replace the legitimate bootloader with one of these outdated shims. Because Microsoft’s signature remains valid, the UEFI firmware trusts it and loads the shim without complaint. From there, the shim can hand off control to unsigned, malicious code—effectively neutering Secure Boot.
“An attacker exploiting one of these vulnerable applications can execute untrusted code during system boot, enabling deployment of malicious UEFI bootkits or other malware,” the researchers explained in their advisory. Once a bootkit is in place, it can load before the operating system, hide from antivirus, and persist across reinstallations.
The 11 shims were all signed by Microsoft years ago. They were intended for older Linux distributions, like Ubuntu 12.04 or Fedora 18, that needed a compatibility layer to boot on UEFI systems. But those distros are long dead, while the signed shims live on—still trusted by every modern PC that ships with Microsoft’s UEFI certificate.
Who’s at Risk? Nearly Everyone
This isn’t a niche threat. Secure Boot is enabled by default on Windows 10 and 11 PCs, as well as on most major Linux distributions that support UEFI. The vulnerability affects any system that trusts Microsoft’s UEFI CA certificate—which is essentially every x86 device sold in the last decade.
That includes:
- Consumer laptops and desktops from Dell, HP, Lenovo, and others
- Enterprise workstations and servers
- Virtual machines that emulate UEFI firmware
- Some ARM-based devices using UEFI
The researchers tested the shims against UEFI firmware from American Megatrends (AMI), Insyde, and Phoenix—the three dominant firmware vendors. All three allowed the exploit to succeed. It’s a clean sweep.
Why Microsoft Didn’t Revoke the Shims Sooner
Revoking a signed binary isn’t trivial. Microsoft maintains a Secure Boot revocation list that firmware updates can apply. But adding old shims to that list could break boot for anyone still running those ancient Linux distros. The company faces a classic security-versus-compatibility tradeoff.
Still, the researchers argue that leaving these shims active is a worse outcome. “The risk of a widespread bootkit campaign outweighs the compatibility concerns for obsolete operating systems,” one of them told Ars Technica. Microsoft has since released a security advisory (CVE-2024-21305) and updated the revocation list in a January 2024 Windows update. But the fix only applies to Windows—Linux users need to update their firmware manually.
What You Can Do to Protect Yourself
First, apply the latest firmware updates from your PC manufacturer. Most major vendors—Dell, HP, Lenovo—have released UEFI updates that incorporate Microsoft’s new revocation list. Check your support page.
Second, if you’re running Linux, make sure your boot shim is current. The major distros have all shipped updated shims that aren’t vulnerable. Run sudo shim-review or check your package manager for the shim-signed package.
Third, consider enabling additional boot security features like Measured Boot or a Trusted Platform Module (TPM). These can detect tampering even if Secure Boot is bypassed.
Finally, don’t assume Secure Boot is a silver bullet. It’s a strong layer of defense, but it’s not impenetrable. The discovery of these 11 old shims is a reminder that cryptographic trust is only as good as the revocation process behind it.
For more on how to secure your boot chain, check out our guide on UEFI firmware security best practices and the latest on bootkit detection tools.
