shim

Looking at the commit in isolation can be somewhat misleading. If you look at the surrounding code https://github.com/rhboot/shim/blob/0226b56513b2b8bd5fd281bc..., it's receiving chunks of data in a loop, checking to make sure new data does not exceed the buffer capacity (determined by Content-Length) each time. However, previously it wasn't checking that on the very first read outside the loop, hence the bug. I don't see any final check on downloaded == *buf_size (Content-Length) though. Violating that could indicate premature connection close.

A new mechanism called SBAT (https://github.com/rhboot/shim/blob/main/SBAT.md) is now used to allow revocation of groups of bootloaders rather than individual hashes in order to mitigate the resource consumption

Here's the bug: https://github.com/rhinstaller/shim/issues/55 And PR: https://github.com/rhinstaller/shim/pull/60 Hopefully $DISTRO will patch it soon so you can enroll keys. : )

Lots and lots of reading of lots and lots of sometimes obscure documentation. For writing code that ends up on a thunderbolt device, you need to keep in mind that other than the endpoint, thunderbolt devices are essentially PCIe devices. So, a device with an easily writable firmware, like certain broadcom chips that come with a lot of apple hardware [1] can be easily programmed to suit the whims of the attacker. Regarding reading, and writing, there is a ton of info that is kept on a partition on disk, actually, in the EFI system partition [2]. Additionally, there are basic uefi development tools out there that let you write your own uefi payloads [3]. Finally, take a look at TianoCore for an Open reference implementation of UEFI, as it has a lot more ins and outs as how to do all this [4]. [1] https://www.broadcom.com/collateral/pg/5778