CME-111
Secure Boot (UEFI)
Description
Firmware-level verification that only signed bootloaders and kernels execute, preventing boot-level rootkits and unauthorized kernel replacement.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Integrity (I) | H → L | Cannot persist malicious bootloader or kernel modifications |
| Attack Complexity (AC) | L → H | Must bypass cryptographic verification chain |
CWE Relationships
Verification
Check UEFI Secure Boot state
$ mokutil --sb-state
# Expected: SecureBoot enabled
# Expected: SecureBoot enabled
Platform: linux
$ Confirm-SecureBootUEFI
# Expected: True
# Expected: True
Platform: windows
Applicability (CVE 5.2.0 Schema)
| Vendor | Product | CPEs | Platforms | Status |
|---|---|---|---|---|
| microsoft | windows |
cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_11:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*
|
All | applicable |