Microsoft Revokes 11 Old Secure Boot Shims After 13-Year Bypass Risk Found

ESET researchers found 11 firmware images, at least one dating to 2013, that Microsoft had signed but never revoked after defects were identified. The images, known as shims, were created to extend Secure Boot to Linux distributions and third-party utilities.

The shims allow an attacker with physical access to load unsigned code during the boot process on both Windows and Linux systems. ESET stated that no new vulnerability is required; possession of an unrevoked shim binary is sufficient to bypass the protection.

How the revocation gap occurred Microsoft oversees the signing of shims and maintains revocation lists through the db and dbx databases. When space constraints made full listing impractical, the company adopted version-based revocation methods such as SBAT and Secure Boot SVN.

The 11 shims predate these mechanisms or contain code that does not enforce them. Microsoft revoked the binaries in its June monthly update after ESET notified CERT.

Scope of affected systems Windows users who installed the June update are no longer exposed. Linux users can verify revocation status through the Linux Vendor Firmware Service or the uefi-dbx-audit script. ESET noted that the lapse leaves open the possibility that attackers could have installed persistent bootkits on affected devices for more than a decade.