Unrevoked Bootloader Shims Break Microsoft Secure Boot

Microsoft never revoked a set of old bootloader shims, leaving Secure Boot bypassable for roughly its entire existence, per Ars Technica.

Secure Boot is the root of trust that measured boot and disk-encryption attestation chains depend on. Every enterprise compliance assumption built on that chain inherits the flaw.

Not some rare exploit chain. Ars Technica describes them as old, forgotten bootloaders Microsoft never pulled from the trusted list, which is what makes the bypass trivial, not theoretical.

The report didn't land on its own. It arrived the same week as a record-size Patch Tuesday and an actively exploited Windows 0-day, per Ars Technica.

Patching the specific shims Ars Technica names won't close this out. Microsoft's revocation process is what let known-bad bootloaders stay trusted for years, and that's the same process that has to catch the next batch.

Any compliance program that keys attestation off "Secure Boot is on" needs to check what's actually in the trusted bootloader list. Checking whether the setting is flipped isn't enough.