{"id":182184,"date":"2024-02-07T00:22:48","date_gmt":"2024-02-07T06:22:48","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2024\/02\/critical-vulnerability-affecting-most-linux-distros-allows-for-bootkits"},"modified":"2024-02-07T00:22:48","modified_gmt":"2024-02-07T06:22:48","slug":"critical-vulnerability-affecting-most-linux-distros-allows-for-bootkits","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2024\/02\/critical-vulnerability-affecting-most-linux-distros-allows-for-bootkits","title":{"rendered":"Critical vulnerability affecting most Linux distros allows for bootkits"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/critical-vulnerability-affecting-most-linux-distros-allows-for-bootkits.jpg\"><\/a><\/p>\n<p>Linux developers are in the process of patching a high-severity vulnerability that, in certain cases, allows the installation of malware that runs at the firmware level, giving infections access to the deepest parts of a device where they\u2019re hard to detect or remove.<\/p>\n<p>The vulnerability resides in shim, which in the context of Linux is a small component that runs in the firmware early in the boot process before the operating system has started. More specifically, the shim accompanying virtually all Linux distributions plays a crucial role in secure boot, a protection built into most modern computing devices to ensure every link in the boot process comes from a verified, trusted supplier. Successful exploitation of the vulnerability allows attackers to neutralize this mechanism by executing malicious firmware at the earliest stages of the boot process before the <a href=\"https:\/\/en.wikipedia.org\/wiki\/UEFI\">Unified Extensible Firmware Interface<\/a> firmware has loaded and handed off control to the operating system.<\/p>\n<p>The vulnerability, tracked as CVE-2023\u201340547, is what\u2019s known as a buffer overflow, a coding bug that allows attackers to execute code of their choice. It resides in a part of the shim that processes booting up from a central server on a network using the same HTTP that the Internet is based on. Attackers can exploit the code-execution vulnerability in various scenarios, virtually all following some form of successful compromise of either the targeted device or the server or network the device boots from.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Linux developers are in the process of patching a high-severity vulnerability that, in certain cases, allows the installation of malware that runs at the firmware level, giving infections access to the deepest parts of a device where they\u2019re hard to detect or remove. The vulnerability resides in shim, which in the context of Linux is [\u2026]<\/p>\n","protected":false},"author":662,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,418],"tags":[],"class_list":["post-182184","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode","category-internet"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/182184","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/662"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=182184"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/182184\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=182184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=182184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=182184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}