LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49357: efi: Do not import certificates from UEFI Secure Boot for T2 Macs

In the Linux kernel, the following vulnerability has been resolved: efi: Do not import certificates from UEFI Secure Boot for T2 Macs On Apple T2 Macs, when Linux attempts to read the db and dbx efi variables at early boot to load UEFI Secure Boot certificates, a page fault occurs in Apple firmware code and EFI runtime services are disabled with the following logs: [Firmware Bug]: Page fault caused by firmware at PA: 0xffffb1edc0068000 WARNING: CPU: 3 PID: 104 at arch/x86/platform/efi/quirks.c:735 efi_crash_gracefully_on_page_fault+0x50/0xf0 (Removed some logs from here) Call Trace: <TASK> page_fault_oops+0x4f/0x2c0 ? search_bpf_extables+0x6b/0x80 ? search_module_extables+0x50/0x80 ? search_exception_tables+0x5b/0x60 kernelmode_fixup_or_oops+0x9e/0x110 __bad_area_nosemaphore+0x155/0x190 bad_area_nosemaphore+0x16/0x20 do_kern_addr_fault+0x8c/0xa0 exc_page_fault+0xd8/0x180 asm_exc_page_fault+0x1e/0x30 (Removed some logs from here) ? __efi_call+0x28/0x30 ? switch_mm+0x20/0x30 ? efi_call_rts+0x19a/0x8e0 ? process_one_work+0x222/0x3f0 ? worker_thread+0x4a/0x3d0 ? kthread+0x17a/0x1a0 ? process_one_work+0x3f0/0x3f0 ? set_kthread_struct+0x40/0x40 ? ret_from_fork+0x22/0x30 </TASK> ---[ end trace 1f82023595a5927f ]--- efi: Froze efi_rts_wq and disabled EFI Runtime Services integrity: Couldn't get size: 0x8000000000000015 integrity: MODSIGN: Couldn't get UEFI db list efi: EFI Runtime Services are disabled! integrity: Couldn't get size: 0x8000000000000015 integrity: Couldn't get UEFI dbx list integrity: Couldn't get size: 0x8000000000000015 integrity: Couldn't get mokx list integrity: Couldn't get size: 0x80000000 So we avoid reading these UEFI variables and thus prevent the crash.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This issue affects Linux running on Apple T2 Macs. During early boot, Linux may trigger an Apple firmware fault while reading Secure Boot certificate variables, causing EFI runtime services to be disabled. The sources describe a reliability and integrity-loading failure path, not a remote compromise scenario.

Executive priority

Treat this as low urgency unless your environment relies on Linux on Apple T2 Macs. The main concern is boot-time platform integrity behavior and EFI service availability, not broad enterprise compromise.

Technical view

The Linux EFI path attempted to read UEFI Secure Boot db and dbx variables on Apple T2 systems. Apple firmware could page fault inside EFI runtime services, after which Linux disabled EFI runtime services and failed to load UEFI db, dbx, and related integrity lists. The fix avoids importing those variables on T2 Macs.

Likely exposure

Exposure appears limited to Apple T2 Mac hardware running affected Linux kernel versions or branches before the referenced stable fixes. General Linux servers, cloud workloads, and non-T2 hardware are not identified as affected in the provided sources.

Exploitation context

The source bundle does not show active exploitation, KEV listing, exploit code, or a remote attack path. The described trigger occurs during early boot when the kernel reads specific EFI variables on Apple T2 firmware.

Researcher notes

Evidence is strongest for the kernel failure mode and fix direction. The bundle lacks CVSS, CWE, proof of exploitation, and distribution-specific affected package data, so validation should focus on hardware, kernel branch, boot logs, and patch inclusion.

Mitigation direction

  • Update affected Linux kernels to versions containing the referenced stable fixes.
  • Use vendor or distribution kernel advisories to select the correct patched package.
  • Prioritize Apple T2 Macs that boot Linux with Secure Boot or integrity features enabled.
  • If a patch path is unclear, check upstream Linux and distro guidance.

Validation and detection

  • Inventory Linux systems running on Apple T2 Mac hardware.
  • Check kernel versions against affected ranges and stable fix inclusion.
  • Review boot logs for EFI page fault and disabled runtime services messages.
  • Confirm patched systems no longer log UEFI db or dbx read failures.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49357 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux15ea0e1e3e185040bed6119f815096f2e4326242, 15ea0e1e3e185040bed6119f815096f2e4326242, 15ea0e1e3e185040bed6119f815096f2e4326242, 15ea0e1e3e185040bed6119f815096f2e4326242, 15ea0e1e3e185040bed6119f815096f2e4326242, 15ea0e1e3e185040bed6119f815096f2e4326242unaffected
LinuxLinux5.0, 0, 5.4.198, 5.10.121, 5.15.46, 5.17.14, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.