The Data Execution Prevention (DEP), No Execute (NX), or Execute Disable (XD) memory protection features, prevents code from running that is marked as non-executable. These features have been available in Oracle Linux at the operating system level but not as part of bootloaders. Oracle Linux now includes the DEP/NX function in the GRUB and shim boot loaders. This functionality might prevent some vulnerabilities during the pre-boot stage, such as a malicious EFI drivers that might run attacks without the DEP/NX protection.

With this release, the GRUB and shim boot loaders can handle Trust Domain (TD) measurement protocol.

For TD virtual machine guest environments, all components in the boot chain, such as grub2 and shim, must log the event and measurement hash to the runtime measurement registers (RTMR).

TD guest runtime measurement in RTMR is the base for attestation applications. Applications on the TD guest rely on the TD measurement to provide evidence of the state of the system and to obtain confidential information, such as the key from the relaying party of the attestation service.