CME-111

Secure Boot (UEFI)

Harden OS/Kernel Unquantified evidence Preventive

Description

Firmware-level verification that only signed bootloaders and kernels execute, preventing boot-level rootkits and unauthorized kernel replacement.

CVSS Vector Impacts

Metric	Transition	Rationale
Integrity (I)	H → L	Cannot persist malicious bootloader or kernel modifications
Attack Complexity (AC)	L → H	Must bypass cryptographic verification chain

CWE Relationships

CWE-345 CWE-494 CWE-269 CWE-347

Verification

Check UEFI Secure Boot state

$ mokutil --sb-state
# Expected: SecureBoot enabled

Platform: linux

$ Confirm-SecureBootUEFI
# Expected: True

Platform: windows

Remediation

linux UEFI Secure Boot verification and MOK key enrollment


mokutil --sb-state | grep -q 'SecureBoot enabled' && echo 'PASS: Secure Boot enabled' || echo 'FAIL: Secure Boot disabled — enable in UEFI firmware settings'
mokutil --import <mok_public_key>.der
sign-file sha256 <private_key>.priv <mok_public_key>.der <module>.ko

Applicability (CVE 5.2.0 Schema)

Vendor	Product	CPEs	Platforms	Status
microsoft	windows	`cpe:2.3:o:microsoft:windows_10::::::::` `cpe:2.3:o:microsoft:windows_11::::::::` `cpe:2.3:o:microsoft:windows_server_2019:::::::` `cpe:2.3:o:microsoft:windows_server_2022:::::::`	All	applicable