VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

What happened

UEFI Secure Boot helps ensure that only trusted and digitally signed software is executed during these early stages of platform initialization. Description The Unified Extensible Firmware Interface (UEFI) is a firmware specification that defines the interface between a computing platform's hardware and operating system (OS) during the early boot process before the operating system is loaded.

The TianoCore EDK II project provides an open-source reference implementation of the UEFI and Platform Initialization (PI) specifications. The project contains the UEFI Shell , which provides command-line utilities for debugging, diagnostics, and advanced platform management.

Many OEM and Independent BIOS Vendor (IBV) firmware implementations include the UEFI Shell in SPI flash for service and support purposes. Because the shell executes in the pre-boot environment, it provides powerful commands such as dmem (display memory) and mm (memory modify) that can access physical memory.

Key facts

• The TianoCore EDK II project — provides: an open-source reference implementation of the UEFI and Platform Initialization (PI) specifications
• The project — includes: the UEFI Shell , which — provides: command-line utilities for debugging, diagnostics, and advanced platform management
• Because the shell executes in the pre-boot environment, it — provides: powerful commands such as dmem (display memory) and mm (memory modify) that can access physical memory