Description

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject malicious kernel command line parameters that execute with boot environment privileges without triggering TPM PCR measurement failures, as the attack does not modify the measured boot code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-28T22:16:55.067Z",
  "pubdate": "2026-08-28T22:16:55.067Z",
  "executiveSummary": "A critical vulnerability exists in IGEL OS 12 (before 12.7.6) and IGEL OS 11 (before 11.11.150) involving improper validation of boot registry parameters.\nThis vulnerability allows an attacker with physical access to the device to inject arbitrary Linux kernel command-line parameters by modifying unencrypted and unsigned configuration storage.\nBecause the bootloader reads these parameters from an external location without verification, an attacker can influence the early boot process to execute with elevated privileges.\nCrucially, this modification does not alter the measured boot code, meaning the attack successfully evades TPM-based PCR validation, rendering standard measured boot integrity checks ineffective.\nThe primary risk involves full system compromise, as arbitrary kernel parameters can be used to bypass security controls, drop into a root shell, or exfiltrate sensitive data before the OS is fully initialized.\nExploitation requires direct physical access to the target hardware to modify the specific configuration area, as the vulnerability is restricted to the pre-boot environment.",
  "technicalDetails": "The vulnerability resides in the interaction between the IGEL OS bootloader and its external configuration registry. The system utilizes an unencrypted and unsigned configuration memory area to store boot-time settings and kernel parameters.\nThe root cause is the lack of cryptographic signature verification on the configuration data consumed by the bootloader during the initial execution phase. Although the bootloader itself is signed and measured, the configuration parameters it processes are not included in the chain of trust.\nThe attack flow begins with the adversary gaining physical access to the storage medium or the interface where the boot registry resides. By overwriting the contents of this configuration area, an attacker can append or modify kernel command-line arguments. For example, parameters such as 'init=/bin/sh' can be injected to force the system to spawn a shell with root privileges prior to the initialization of the secure OS environment.\nBecause the bootloader remains signed and its integrity is verified by the UEFI/TPM process, the platform's measured boot state (PCRs) remains unchanged. The TPM measurements record the state of the executable code, not the dynamic parameters provided to the kernel. Consequently, the system remains in a 'trusted' state according to the TPM, despite the underlying configuration being compromised.\nThe exploitation process occurs during the early stages of the boot sequence. As the bootloader fetches the configuration parameters from the unprotected area, it parses the malicious strings and passes them to the Linux kernel. The kernel then executes with the injected flags, overriding intended security policies, disabling kernel lockdown features, or mounting alternative filesystems.\nThis vulnerability effectively bypasses the integrity protection provided by secure boot mechanisms by manipulating the data that instructs the bootloader on how to load the operating system. No authentication is required for this attack, provided physical access is achieved, and it does not require network exposure."
}