First some definitions and common understanding.

The premise of secure boot is that each binary get's verified before it is loaded. This starts with the firmware in ROM verifying the EFI application.

For the case of a Linux boot that EFI application is shim which is signed with a Microsoft key embedded in most x86/64 hardware. The rom verifies and runs shim.

Shim verifies and runs grub (the most commonly used bootloader for Linux in x86).

Grub then verifies and runs the kernel, which verifies and mounts the rootfs and handles control to user-space apps.

The problem is grub usually has a config file grub.cfg which is accessible from user-space. By allowing user-space to modify this file the chain of trust gets broken and a malicious user-space app can now enable installation of a compromised kernel.

It is true that the userspace loaded will initially be coming from a verified kernel, but userspace has a much larger attack surface then just the boot process. So a compromised userspace allows for installation of a compromised kernel and an even more compromised userspace.

How is grub.cfg usually protected?

  • 1
    Did you overlook "Grub then verifies and runs the kernel". Modifying the config can only load a properly signed kernel binary. The chain depends on the attacker not having the correct key to sign his compromised kernel.
    – Ben Voigt
    Commented Sep 30, 2021 at 15:55
  • Now, failure to verify the config file could be used for other attacks, such as a downgrade attack by loading an older legitimate kernel created prior to patches for known vulnerabilities. But can't load an arbitrary kernel created by the attacker.
    – Ben Voigt
    Commented Sep 30, 2021 at 15:56
  • Updated with new context. Commented Oct 1, 2021 at 7:50
  • Compromised user-space can copy a new kernel to the filesystem, and can modify grub.cfg to point to it, but it won't boot because it is not properly signed. That is the protection, stated in the very first sentence you quoted.
    – Ben Voigt
    Commented Oct 1, 2021 at 15:10


You must log in to answer this question.

Browse other questions tagged .