Approximately 200,000 Linux systems from the American manufacturer Framework were shipped with signed UEFI Shell components that can be used to bypass Secure Boot. Attackers can exploit the issue to load bootkits that circumvent OS-level protections and persist even after the OS is reinstalled.
According to experts at Eclypsium, the vulnerability is tied to the presence of the memory modify (mm) command in officially signed UEFI shells that Framework ships with its devices.
The command provides direct read and write access to system memory and is intended for low-level firmware diagnostics and debugging. However, it can be used to break the Secure Boot chain of trust by attacking the gSecurity2 variable — a critical component of the UEFI module signature verification process.
The mm command can be used to overwrite gSecurity2 with a NULL value, effectively disabling signature verification. In addition, the researchers note that the attack can be automated via autorun scripts, allowing the threat to persist even after a reboot.
The presence of the mm command is not the result of a compromise but a simple mistake. After being informed of the issue, Framework specialists began working to address the vulnerability.
Eclypsium researchers believe that the bug has affected approximately 200,000 Framework devices:
- Framework 13 (11th Gen Intel) — patch planned in version 3.24;
- Framework 13 (12th Gen Intel) — fixed in version 3.18, DBX update planned in version 3.19;
- Framework 13 (13th Gen Intel) — fixed in version 3.08, DBX update released in version 3.09;
- Framework 13 (Intel Core Ultra) — fixed in version 3.06;
- Framework 13 (AMD Ryzen 7040) — fixed in version 3.16;
- Framework 13 (AMD Ryzen AI 300) — fixed in version 3.04, DBX update planned in version 3.05;
- Framework 16 (AMD Ryzen 7040) — fixed in version 3.06 (Beta), DBX update released in version 3.07;
- Framework Desktop (AMD Ryzen AI 300 MAX) — fixed in version 3.01, DBX update planned in version 3.03.
Users of affected devices are advised to install the available updates. If a patch is not yet available, it’s critical to use additional protective measures, such as restricting physical access to the device. Another temporary mitigation is to delete the Framework DB key via the BIOS.