News for hackers. Stuff that matters.

A comment on CVE-2023-40547 – avoid incorrectly trusting HTTP headers. Parent comment

Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by cesarb on Thursday January 25, 2024 @02:54PM (#39134300)
> I'm curious how shim avoids the issue Microsoft is concerned about.

IIRC, shim has a way to allow someone physically present to add additional keys which will also by trusted by that instance of shim. That's enough to satisfy the GPL requirements.

[ Parent | on HN ]
Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by Arnavion on Thursday January 25, 2024 @02:59PM (#39134369)
Yes, that is how the MOK enrolment process works. The distro drops its MOK (the one it used to sign the kernel into the distro kernel package) into the ESP. On next boot shim notices the new key and asks the user if they want to enroll it. Similarly if the user wants to enroll additional keys for kernel modules they built themselves or got from somewhere else, they can do the same process.
[ Parent | on HN ]