As usual, there are prophetic warnings from Linus:<p><a href="https://yarchive.net/comp/linux/efi.html" rel="nofollow">https://yarchive.net/comp/linux/efi.html</a><p>BIOS should be simple, because it is buggy anyway. Handing over to a bootloader in the MBR is all that a BIOS should do. Now one is at the mercy of NVRAM, grub2 and loads of gratuitous complexity.
Ubuntu had this as well, but got a release out quickly so it seems to have not been too huge an issue.<p>Bug report: <a href="https://bugs.launchpad.net/cloud-init/+bug/1877491" rel="nofollow">https://bugs.launchpad.net/cloud-init/+bug/1877491</a><p>Description/remediation: <a href="https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass?_ga=2.62301103.2044889230.1596151413-1800768090.1596151413" rel="nofollow">https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2Secu...</a>
Number of users saved from attack by secure boot: 0
Number of systems bricked by fixes to secure boot vulnerabilities: Many<p>Sad to see TSA in software form.
We have a centos 8 server that has been bricked, and there doesn't seem to be any solution right now. Downgrading the packages shows "lowest version already installed, cannot downgrade it.", and I can't manually install the old packages because there doesn't seem to be any way of getting them. Someone says to use <a href="http://mirror.centos.org/centos-8/8.2.2004/BaseOS/x86_64/os/Packages/" rel="nofollow">http://mirror.centos.org/centos-8/8.2.2004/BaseOS/x86_64/os/...</a> but that seems to have the very latest packages and even after updating the affected ones it still fails to boot.
Hey all, just wanted to make you aware of the mortar project here: <a href="https://github.com/noahbliss/mortar" rel="nofollow">https://github.com/noahbliss/mortar</a><p>It takes a comprehensive approach rather than piecemeal like a lot of these patches, leveraging technology already in your system to build a conceptually airtight and fully audited system. Happy to get some of your opinions on it, constructive criticism, and pull requests!