Conversation
first bugzilla interaction from that user's email address so i feel absolutely no need to hold back
1
0
0

@flussence

Steps to Reproduce:
1.Use PXE on a network with a malicious actor

buddy those steps work even without the bug

1
0
0

@ben @flussence aside from the bug not being applicable for like basically anyone, actually yeah it does matter because it sounds like it can skip secureboot signature requirements which is kind of the only security model the pc platform has, lol

1
0
1

@charlotte @flussence can't you just load a signed linux kernel with an init that runs your exploit? secureboot seems kinda useless when you're feeding it the entire OS

1
0
0

@ben @flussence the modern way you would do this basically boils down to to bundling kernel, kernel arguments, and initramfs into a single .efi binary that is then signed as a whole. And i guess the access/encryption credentials for the network storage device gets loaded from the TPM

1
0
1

@ben @flussence minus the network part, this is basically how i have set up my UEFI systems at home too

1
0
1

@ben @flussence Also, it might be some sort of recovery option that is supposed to be selectively enabled (but all systems still ask for the PXE boot image anyways)

0
0
1