aavmf

About this tag
The aavmf tag covers discussions about the ARM64 QEMU UEFI firmware binary, particularly in the context of security vulnerabilities. Recent content highlights CVE-2025-2486, a firmware issue in Ubuntu's edk2 packages where the UEFI Shell remained accessible inside AAVMF even with Secure Boot enabled, potentially allowing Secure Boot bypasses in virtualized environments. This tag is relevant for users managing ARM64 virtual machines with UEFI and Secure Boot, especially those using Ubuntu or other Linux distributions that package AAVMF. Topics include firmware security, Secure Boot integrity, and patching edk2 images to prevent unauthorized access.

  1. CVE-2025-2486: UEFI Shell exposure in Ubuntu ARM64 AAVMF undermines Secure Boot

    Canonical's security team has disclosed CVE-2025-2486, a firmware-level issue in Ubuntu's edk2 packages that left the UEFI Shell accessible inside AAVMF (the ARM64 QEMU UEFI binary) even when Secure Boot was enabled — a configuration that can permit Secure Boot bypasses in affected virtualized...