348
Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability (www.theregister.com)
submitted 2 years ago by to c/technology@lemmy.world
16 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 2 years ago (2 children)

Huh. I must be outdated. I didn’t know they got secure boot working. So what do you do when you need to update your kernel? Or does the fact that it comes from the package manager mean that it is allowed to update that?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 4 points 2 years ago (1 child)

    Generally yes. For many distros, the kernel signing key is with the distro maintainers and so the package comes with pre-signed kernel images. For distros like Arch and Gentoo, it's the user's responsibility to maintain the signing key and sign each updated kernel

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 2 years ago

    The package manager doesn't have special permission. The new kernel you download is also signed for you and trusted by your system.

    If it wasn't trusted, would the next time you boot the kernel won't load because the bootloader will refuse to load the unsigned code.

  • permalink
  • fedilink
  • source
  • parent