Remember last year’s BootHole security vulnerabilities? Well, it looks like no less than eight (8) new security flaws were discovered in the GRUB2 bootloader allowing attackers to bypass UEFI Secure Boot, and it affects almost all GNU/Linux distributions using GRUB2 versions prior to 2.06.
These include CVE-2020-14372, which allows a privileged user to load crafted ACPI tables when Secure Boot is enabled, and CVE-2021-20233, which lets an attacker with local root privileges to drop a small SSDT in /boot/efi and modify grub.cfg to instruct the GRUB bootloader to load said SSDT and overwrite the kernel lockdown configuration, thus enabling the attacker to load unsigned kernel modules and kexec unsigned code.