Saint Shim Shady, the Real Bootloader

Patron of bootloaders, network boot, and programs that start before everyone else.

Life

In February 2024 Eclypsium told the story of CVE-2023-40547, found by Bill Demirkapi of the Microsoft Security Response Center: shim, the tiny bootloader that lets almost every Linux distribution start under Secure Boot, trusted the data it received during HTTP network boot too much. An attacker able to intercept that traffic could take over the machine before the operating system even started.

Prayer

O Saint Shim Shady, who rises before everyone, keep our bootloaders from believing every HTTP response. Amen.

How to celebrate

Celebrated by updating shim to 15.8, revoking the old ones with SBAT and, by tradition, asking the real Shim Shady to please stand up.

Whoever starts first decides for everyone.