GRUB2 (direct kernel boot without shim): When GRUB is booted directly by UEFI rather than chained through shim, it does

Impact

When GRUB is booted directly by UEFI rather than chained through shim, it does not verify the kernel signature at all. Any unsigned kernel boots with Secure Boot enabled and reporting healthy - so attestation and the operator's 'verified boot' control are simply false on those nodes. Confidential-computing claims built on measured boot become unverifiable.

Who can reach it

Applies to any node configured to load GRUB directly from the EFI System Partition. The attacker then only needs to drop a kernel, which any local root can do.

What to do

grub2 package update + reboot, and audit the boot configuration on every node to confirm shim is actually in the chain - a surprising number of custom/netboot images skip it. This is one of the few in this family where a config check is a genuine part of the fix, not just a workaround.

References