I haven't seen any seen mechanism by which UEFI can detect the most recent update to a binary from being swapped out for an older binary that was signed with the same key as the up-to-date binary. Google's vboot is the only PC firmware I know of that uses anti-downgrade counters. Does the UEFI specification specify a way to thwart rollback attacks?
1 Answer
UEFI of what ?
Generally, there was no such specification initially.
The latest UEFI specs can be found here.
Some manufacturers use something called "Secure Rollback Prevention”. If enabled, it prevents any downgrade.
For example, Lenovo Thinkserver series implemented this in order to prevent people using security-flawed versions. For specific models, the BIOS cannot be downgraded to a level lower than the version listed once the BIOS is at that level or higher.
You will have to see if your UEFI has such a feature, but note that even if there is one, it may be bypass-able.
Since something like this is possible, a forced downgrade even with an option to protect against it may be trivial to accomplish.
