Firmware security company Eclypsium has claimed that 200,000 Framework laptops and desktops that are running Linux have shipped with "what can only be described as signed backdoors." This is because they've shipped with UEFIs that allow memory read/write access that can apparently be used to compromise Secure Boot. And apparently "this situation is not unique to Framework."
That's according to the security company, which notes that UEFI shells that enable these vulnerabilities aren't backdoors placed by bad actors for malicious purposes (via Bleeping Computer). "Instead, they’re legitimate diagnostic tools signed with trusted certificates that contain functionality to effectively bypass security controls we’ve built into the boot process" the company says. "The implications? Systems that have a secure boot process, in reality, do not."
