200,000 Linux systems from Framework are shipped with signed UEFI components vulnerable to Secure Boot bypass

Firmware security company Eclypsium warns that about 200,000 Linux systems from Framework are shipped with signed UEFI shells vulnerable to a Secure Boot bypass, enabling bootkit installation and persistence. The article explains that signed UEFI shells are legitimate diagnostic tools signed with trusted certificates, which can be abused to bypass security controls in the boot process, including a memory-modify command that grants direct read/write access to system memory.

Attackers can use this to overwrite the gSecurity2 UEFI variable, disable signature verification, and load unsigned bootkits or rootkits, potentially allowing persistent pre-OS access. The researchers found that Framework-signed shells could alter memory and bypass Secure Boot, with over 200,000 Framework devices implicated; fixes vary by model, for example 13th Gen Intel (3.08) and Ryzen 7040 (3.16) are fixed, while others await updates. Framework is issuing DBX updates to blacklist vulnerable shells.

The report concludes that the attack surface below the operating system remains a major risk, enabling continued exploitation across firmware, bootloaders and hardware components.