V\u00fdvoj\u00e1\u0159i Fedora Linux objasnili situaci ohledn\u011b vypr\u0161en\u00ed platnosti certifik\u00e1tu Microsoft, kter\u00fd je aplikov\u00e1n pro ov\u011b\u0159ov\u00e1n\u00ed digit\u00e1ln\u00edho podpisu vrstvy Shim, pou\u017e\u00edvan\u00e9 pro ov\u011b\u0159en\u00fd start distribuc\u00ed Linuxu v re\u017eimu UEFI Secure Boot na konci \u010dervna. P\u0159echod na nov\u00fd certifik\u00e1t by m\u011bl prob\u011bhnout pro u\u017eivatele bez viditeln\u00e9ho z\u00e1sahu, proto\u017ee faktick\u00e9 vypr\u0161en\u00ed platnosti certifik\u00e1tu povede pouze k nemo\u017enosti jeho pou\u017eit\u00ed pro vytv\u00e1\u0159en\u00ed nov\u00fdch podpis\u016f. B\u011bhem startu UEFI Secure Boot se platnost certifik\u00e1tu nekontroluje a je d\u016fle\u017eit\u00fd pouze pro sta\u017een\u00ed zkompromitovan\u00fdch certifik\u00e1t\u016f. <\/p>\n
St\u00e1vaj\u00edc\u00ed syst\u00e9my bez instalace aktualizace shim budou pokra\u010dovat v zav\u00e1d\u011bn\u00ed do doby, ne\u017e bude ve\u0159ejn\u00fd kl\u00ed\u010d certifik\u00e1tu odstran\u011bn z firmware nebo za\u0159azen na seznam odvolan\u00fdch certifik\u00e1t\u016f UEFI (DBX). Kl\u00ed\u010d Microsoftu ov\u011b\u0159uje pouze zav\u00e1d\u011bc\u00ed vrstvu shim, v n\u00ed\u017e je p\u0159\u00edtomen ve\u0159ejn\u00fd kl\u00ed\u010d distribuce, kter\u00fd se pou\u017e\u00edv\u00e1 pro ov\u011b\u0159ov\u00e1n\u00ed zav\u00e1d\u011bn\u00fdch komponent, jako je zav\u00e1d\u011b\u010d GRUB2, j\u00e1dro Linuxu, moduly j\u00e1dra a procesy pou\u017e\u00edvan\u00e9 p\u0159i startu, jako je fwupd. Takov\u00fd p\u0159\u00edstup umo\u017e\u0148uje ov\u011b\u0159it v Microsoftu pouze zm\u011bny ve vrstv\u011b shim a samostatn\u011b zajistit verifikaci procesu zav\u00e1d\u011bn\u00ed distribuce.<\/p>\n
Certifik\u00e1t Microsoft pro ov\u011b\u0159ov\u00e1n\u00ed t\u0159et\u00edch stran firmware pro UEFI Secure Boot je v platnosti od roku 2011. V roce 2023 byl vytvo\u0159en nov\u00fd certifik\u00e1t, kter\u00fd za\u010dne b\u00fdt pou\u017e\u00edv\u00e1n pro tvorbu podpis\u016f od \u0159\u00edjna 2025. Do repozit\u00e1\u0159e Fedora Rawhide, na jeho\u017e z\u00e1klad\u011b se vytv\u00e1\u0159\u00ed vyd\u00e1n\u00ed Fedora 45, byl ji\u017e p\u0159id\u00e1n aktualizovan\u00fd shim, ov\u011b\u0159en\u00fd n\u011bkolika kl\u00ed\u010di pro zaji\u0161t\u011bn\u00ed maxim\u00e1ln\u00ed kompatibility s hardwarem (m\u016f\u017ee b\u00fdt pou\u017e\u00edv\u00e1n jak na star\u00fdch firmwarech bez ve\u0159ejn\u00e9ho kl\u00ed\u010de nov\u00e9ho certifik\u00e1tu, tak na firmwarech bez ve\u0159ejn\u00e9ho kl\u00ed\u010de star\u00e9ho certifik\u00e1tu).<\/p>\n
I kdy\u017e vypr\u0161en\u00ed platnosti certifik\u00e1tu Microsoft by nem\u011blo ovlivnit funk\u010dnost zav\u00e1d\u011bn\u00ed, v\u00fdvoj\u00e1\u0159i Fedora doporu\u010duj\u00ed u\u017eivatel\u016fm aktualizovat datab\u00e1zi s kl\u00ed\u010di pro Secure Boot, kdy\u017e se objev\u00ed nov\u00e9 verze firmwaru pro jejich za\u0159\u00edzen\u00ed. Pro ur\u010den\u00ed faktu zavad\u011bc\u00edho re\u017eimu UEFI Secure Boot lze pou\u017e\u00edt p\u0159\u00edkaz «mokutil —sb-state», a pro zobrazen\u00ed seznamu dostupn\u00fdch otev\u0159en\u00fdch kl\u00ed\u010d\u016f ve firmware — «mokutil —db —short». Pro zobrazen\u00ed kl\u00ed\u010d\u016f, kter\u00fdmi je podeps\u00e1na vrstvi\u010dka shim, je mo\u017en\u00e9 spustit p\u0159\u00edkaz «sudo pesign -S -i \/boot\/efi\/EFI\/fedora\/shimx64.efi» po p\u0159edchoz\u00ed instalaci bal\u00ed\u010dku pesign. Pro kontrolu p\u0159\u00edtomnosti aktualizace firmwaru a jej\u00ed instalaci lze pou\u017e\u00edt p\u0159\u00edkaz «sudo fwupdmgr update». <\/p>\n
Dal\u0161\u00ed verze vrstvy shim bude ov\u011b\u0159ena pouze nov\u00fdm certifik\u00e1tem Microsoft, a aktualizace firmwaru je nezbytn\u00e1 pro p\u0159\u00edpravu syst\u00e9mu na tuto zm\u011bnu. Aktualizace shim bude vyd\u00e1na v p\u0159\u00edpad\u011b, \u017ee budou zji\u0161t\u011bny zranitelnosti nebo v\u00e1\u017en\u00e9 chyby, co\u017e se m\u016f\u017ee st\u00e1t jak za m\u011bs\u00edc, tak za rok. B\u011bhem existence shim v projektu byly nalezeny kritick\u00e9 zranitelnosti a posledn\u00ed zpr\u00e1va o bezpe\u010dnostn\u00edch probl\u00e9mech v shim byla vyd\u00e1na teprve p\u0159ed n\u011bkolika dny. <\/p>\n
Ve zpr\u00e1v\u011b jsou uvedeny dv\u011b ned\u00e1vno objeven\u00e9 zranitelnosti CVE-2026-8863 a \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Fedora Linux \u043f\u0440\u043e\u044f\u0441\u043d\u0438\u043b\u0438 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u0438\u0441\u0442\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0432 \u043a\u043e\u043d\u0446\u0435 \u0438\u044e\u043d\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Microsoft, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 Shim, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Linux \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 UEFI Secure Boot. \u041f\u0435\u0440\u0435\u0445\u043e\u0434 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u0440\u043e\u0439\u0442\u0438 \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0442\u0430\u043a \u043a\u0430\u043a \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0436\u0438\u0437\u043d\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043f\u0440\u0438\u0432\u0435\u0434\u0451\u0442 \u043b\u0438\u0448\u044c \u043a \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182058","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vypr\u0161\u00ed platnost certifik\u00e1tu, kter\u00fdm je podeps\u00e1n bootloader pro UEFI Secure Boot v distribuc\u00edch Linux | ProHoster","description":"V\u00fdvoj\u00e1\u0159i Fedora Linux objasnili situaci kolem vypr\u0161en\u00ed platnosti certifik\u00e1tu Microsoft, kter\u00fd kon\u010d\u00ed na konci \u010dervna a kter\u00fd je pou\u017e\u00edv\u00e1n k ov\u011b\u0159en\u00ed digit\u00e1ln\u00edho podpisu vrstvy Shim, pou\u017eit\u00fd pro verifikovan\u00e9.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/istekaet-vremya-zhizni-sertifikata-kotorym-zaveren-zagruzchik-dlya-uefi-secure-boot-v-distributivah-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u0442\u0435\u043a\u0430\u0435\u0442 \u0432\u0440\u0435\u043c\u044f \u0436\u0438\u0437\u043d\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0437\u0430\u0432\u0435\u0440\u0435\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0434\u043b\u044f UEFI Secure Boot \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Fedora Linux \u043f\u0440\u043e\u044f\u0441\u043d\u0438\u043b\u0438 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u0438\u0441\u0442\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0432 \u043a\u043e\u043d\u0446\u0435 \u0438\u044e\u043d\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Microsoft, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0438 Shim, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/istekaet-vremya-zhizni-sertifikata-kotorym-zaveren-zagruzchik-dlya-uefi-secure-boot-v-distributivah-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-14T12:48:27+00:00","article:modified_time":"2026-06-14T12:48:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182058","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:23","updated":"2026-08-05 12:22:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/182058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=182058"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/182058\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=182058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=182058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=182058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nCVE-2026-10797, kter\u00e9 umo\u017e\u0148uj\u00ed proveden\u00ed vlastn\u00edho k\u00f3du v ran\u00e9 f\u00e1zi spou\u0161t\u011bn\u00ed p\u0159ed p\u0159ed\u00e1n\u00edm kontroly opera\u010dn\u00edmu syst\u00e9mu, obej\u00edt ochranu UEFI Secure Boot a umo\u017enit spou\u0161t\u011bn\u00ed nezaru\u010den\u00fdch digit\u00e1ln\u011b podepsan\u00fdch komponent j\u00e1dra. Probl\u00e9my se t\u00fdkaj\u00ed verz\u00ed shim do 0.9 v\u010detn\u011b, vytvo\u0159en\u00fdch p\u0159ed rokem 2016. \u00datok\u016fm podl\u00e9haj\u00ed velmi star\u00e9 syst\u00e9my, jako
\n RedHat Enterprise Linux 7.2, CentOS 7.2, Oracle Linux 7.2, ROSA Linux R10\/R9 a openSUSE s shim 0.9. Vrstvy shim do verze 0.9 v\u010detn\u011b byly p\u0159id\u00e1ny do datab\u00e1ze odvolan\u00fdch digit\u00e1ln\u00edch podpis\u016f DBX (UEFI Forbidden Signature Database) a v p\u0159\u00edpad\u011b aktualizace DBX v syst\u00e9mu nebudou moci b\u00fdt pou\u017eity pro spou\u0161t\u011bn\u00ed v re\u017eimu UEFI Secure Boot.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"