The attack exploits debug shells accessible during boot failures, enabling persistent malware injection that survives system reboots and maintains access even after users enter correct passwords for encrypted partitions. Attackers with physical access can bypass Secure Boot protections by exploiting debug shells in the initramfs during boot failures. Multiple incorrect password entries trigger debug access, allowing injection of persistent malware into unsigned initramfs components. Fedora 42 and AlmaLinux 10 present unique challenges as their default initramfs lacks the usb_storage kernel module, but attackers can circumvent this by triggering reboots using Ctrl+Alt+Delete and selecting rescue entries, reads the report. The vulnerability represents what security experts classify as an “evil maid” attack scenario, requiring temporary physical access to compromised systems. These parameters force the system to halt instead of providing debug shell access during boot failures. Additional protective measures include configuring bootloader password requirements for system booting, enabling SSD native encryption, and implementing LUKS encryption for boot partitions.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 07 Jul 2025 11:20:14 +0000