NX_COMPAT shims should force NX_REQUIRE in mok_policy.
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- c
- Domain
- operating-systems, security
Research direction
Start by tracing how mok_policy and the DllCharacteristics NX_COMPAT flag are handled during shim configuration and validation. Reproduce the insecure combination described in the issue, then verify that configurations with NX_COMPAT set without NX_REQUIRE are rejected and that valid combinations still build.
Written by the indexing model from the issue text.
Description
It is currently possible to build a shim with an insecure configuration where NX_COMPAT flag in DllCharacteristics is set but mok_policy does not have NX_REQUIRE flag set.
This should be prevented because such a shim can be booted on NX enforcing firmware and can be used to chainload non-NX binaries and thus becomes an NX bypass tool.
- Dominant language
- C
- Stars
- 1.1k
- Forks
- 348
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rhboot/shim
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
Similar issues
-
[adam] AdamNet network read doesn't cap to MAX_ADAM_PACKET_LEN, overflows client receive buffers Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
FujiNetWIFI/fujinet-firmware#1649 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
HarbourMasters/Shipwright#7229 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
riscv-software-src/riscv-isa-sim#2435 · 1 comment ·
-
bug Self Built Image SNAPSHOT Supported Device target/ramips
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100