---
title: "HOST-BOOT-002 UEFI Secure Boot Disabled"
canonical: https://openvapt.com/checks/HOST-BOOT-002.html
html: https://openvapt.com/checks/HOST-BOOT-002.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-BOOT-002 UEFI Secure Boot Disabled

Checks the firmware's SecureBoot variable to see whether the boot chain is verified.

- Domain: Server
- Severity: Medium
- Control category: Secure Configuration
- Fix effort: high
- CVSS v3.1 vector: `CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
- CIS Controls v8: 4.1
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-1326
- NIST SP 800-53 Rev. 5: SI-7, CM-6
- Benchmark topic: Boot integrity (CIS Controls v8 4.1) (topic only, no benchmark text)

## Why It Matters

Secure Boot makes the firmware refuse unsigned boot loaders and kernels, which blocks boot kits and unsigned kernels planted by an attacker with disk or console access. Without it, anything written to the boot partition runs at the next reboot.

## How It Detects

Reads /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c (the four-byte attribute header followed by one data byte; 1 means enabled). Machines without /sys/firmware/efi boot in legacy BIOS mode and are skipped, as are UEFI machines that expose no SecureBoot variable; an unreadable variable is incomplete. No command such as mokutil is run.

## How to Fix

Enable Secure Boot in the firmware set-up and boot a signed shim and kernel (every mainstream distribution ships them). Custom kernels and out-of-tree modules then need signing with a Machine Owner Key. Where the platform cannot do Secure Boot, record the exception. Caution: unsigned kernels and modules (for example DKMS drivers such as NVIDIA or ZFS) stop loading once it is on, so sign or replace them first and keep console access for the first boot.

## How to Verify

```
mokutil --sb-state  or  od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-*  (the fifth byte is 1 when enabled).
```

## Learn the Theory

- [P17 Kernel, Filesystem and Boot Hardening](https://openvapt.com/academy/p17.md)

## References

- [UEFI Specification, Secure Boot and Driver Signing](https://uefi.org/specs/UEFI/2.10/32_Secure_Boot_and_Driver_Signing.html)
- [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/boot.go

Run it: `openvapt scan --only HOST-BOOT-002`. Read it offline: `openvapt explain HOST-BOOT-002`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-BOOT-002.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.