This is not an issue specific to Linux, Windows installations can be downgraded as well. As for the mechanism, UEFI devices, alongside key updates, also get revocation list updates.
Strangely I feel like I've never seen one of these. It would be needed after every major kernel / user land exploit. It would also need rollback protection on the motherboard itself so you couldn't just remove the updated keys / revocations.
Comments
How do desktop Linux distros avoid attackers from rolling back the operating system to a vulnerable, but signed version?
This is not an issue specific to Linux, Windows installations can be downgraded as well. As for the mechanism, UEFI devices, alongside key updates, also get revocation list updates.
Strangely I feel like I've never seen one of these. It would be needed after every major kernel / user land exploit. It would also need rollback protection on the motherboard itself so you couldn't just remove the updated keys / revocations.