Critical vulnerability affecting most Linux distros allows for bootkits
Critical vulnerability affecting most Linux distros allows for bootkits
Buffer overflow in bootloader shim allows attackers to run code each time devices boot up.
You're viewing a single thread.
I wonder if Matt calculated CVSS score before calling this vulnerability "critical".
It’s the last sentence of the article - 9.8/10. In this case it’s probably called critical because of the potential consequences of the exploit being a full machine takeover, not the likeliness of the exploit being used.
It means that CVSS is calculated wrong. It can't be so big because default configuration is not affected and attacker requires admin access to change it.
Admin or physical access.
I mean take a look at the report. Still not sure how it’s “wrong”.