Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2023-40546
Vulnerability from cvelistv5
Published
2024-01-29 16:29
Modified
2024-11-24 14:18
Severity ?
EPSS score ?
Summary
A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Red Hat | Red Hat Enterprise Linux 7 |
Unaffected: 0:15.8-3.el7 < * cpe:/o:redhat:enterprise_linux:7::server cpe:/o:redhat:enterprise_linux:7::workstation cpe:/o:redhat:enterprise_linux:7::client |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T18:38:50.549Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "RHSA-2024:1834", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { name: "RHSA-2024:1835", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { name: "RHSA-2024:1873", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { name: "RHSA-2024:1876", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { name: "RHSA-2024:1883", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { name: "RHSA-2024:1902", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { name: "RHSA-2024:1903", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { name: "RHSA-2024:1959", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { name: "RHSA-2024:2086", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { tags: [ "vdb-entry", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { name: "RHBZ#2241796", tags: [ "issue-tracking", "x_refsource_REDHAT", "x_transferred", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { tags: [ "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2024/05/msg00009.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:enterprise_linux:7::server", "cpe:/o:redhat:enterprise_linux:7::workstation", "cpe:/o:redhat:enterprise_linux:7::client", ], defaultStatus: "affected", packageName: "shim", product: "Red Hat Enterprise Linux 7", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-3.el7", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:enterprise_linux:7::server", "cpe:/o:redhat:enterprise_linux:7::workstation", "cpe:/o:redhat:enterprise_linux:7::client", ], defaultStatus: "affected", packageName: "shim-signed", product: "Red Hat Enterprise Linux 7", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-1.el7", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:enterprise_linux:8::baseos", ], defaultStatus: "affected", packageName: "shim", product: "Red Hat Enterprise Linux 8", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-4.el8_9", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:rhel_tus:8.2::baseos", "cpe:/o:redhat:rhel_e4s:8.2::baseos", "cpe:/o:redhat:rhel_aus:8.2::baseos", ], defaultStatus: "affected", packageName: "shim", product: "Red Hat Enterprise Linux 8.2 Advanced Update Support", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8_2", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:rhel_tus:8.2::baseos", "cpe:/o:redhat:rhel_e4s:8.2::baseos", "cpe:/o:redhat:rhel_aus:8.2::baseos", ], defaultStatus: "affected", packageName: "shim", product: "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8_2", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:rhel_tus:8.2::baseos", "cpe:/o:redhat:rhel_e4s:8.2::baseos", "cpe:/o:redhat:rhel_aus:8.2::baseos", ], defaultStatus: "affected", packageName: "shim", product: "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8_2", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:rhel_e4s:8.4::baseos", "cpe:/o:redhat:rhel_tus:8.4::baseos", "cpe:/o:redhat:rhel_aus:8.4::baseos", ], defaultStatus: "affected", packageName: "shim", product: "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8_4", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:rhel_e4s:8.4::baseos", "cpe:/o:redhat:rhel_tus:8.4::baseos", "cpe:/o:redhat:rhel_aus:8.4::baseos", ], defaultStatus: "affected", packageName: "shim", product: "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8_4", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:rhel_e4s:8.4::baseos", "cpe:/o:redhat:rhel_tus:8.4::baseos", "cpe:/o:redhat:rhel_aus:8.4::baseos", ], defaultStatus: "affected", packageName: "shim", product: "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8_4", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:rhel_eus:8.6::baseos", ], defaultStatus: "affected", packageName: "shim", product: "Red Hat Enterprise Linux 8.6 Extended Update Support", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8_6", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/a:redhat:rhel_eus:8.8::crb", "cpe:/o:redhat:rhel_eus:8.8::baseos", ], defaultStatus: "affected", packageName: "shim", product: "Red Hat Enterprise Linux 8.8 Extended Update Support", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/a:redhat:rhel_eus:8.8::crb", "cpe:/o:redhat:rhel_eus:8.8::baseos", ], defaultStatus: "affected", packageName: "shim-unsigned-x64", product: "Red Hat Enterprise Linux 8.8 Extended Update Support", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:enterprise_linux:9::baseos", ], defaultStatus: "affected", packageName: "shim", product: "Red Hat Enterprise Linux 9", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-4.el9_3", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:rhel_eus:9.0::baseos", "cpe:/a:redhat:rhel_eus:9.0::crb", "cpe:/a:redhat:rhel_eus:9.0::appstream", ], defaultStatus: "affected", packageName: "shim", product: "Red Hat Enterprise Linux 9.0 Extended Update Support", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-3.el9", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:rhel_eus:9.0::baseos", "cpe:/a:redhat:rhel_eus:9.0::crb", "cpe:/a:redhat:rhel_eus:9.0::appstream", ], defaultStatus: "affected", packageName: "shim-unsigned-aarch64", product: "Red Hat Enterprise Linux 9.0 Extended Update Support", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el9", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:rhel_eus:9.0::baseos", "cpe:/a:redhat:rhel_eus:9.0::crb", "cpe:/a:redhat:rhel_eus:9.0::appstream", ], defaultStatus: "affected", packageName: "shim-unsigned-x64", product: "Red Hat Enterprise Linux 9.0 Extended Update Support", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el9", versionType: "rpm", }, ], }, { collectionURL: "https://access.redhat.com/downloads/content/package-browser/", cpes: [ "cpe:/o:redhat:rhel_eus:9.2::baseos", ], defaultStatus: "affected", packageName: "shim", product: "Red Hat Enterprise Linux 9.2 Extended Update Support", vendor: "Red Hat", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-3.el9_2", versionType: "rpm", }, ], }, ], datePublic: "2024-01-23T00:00:00+00:00", descriptions: [ { lang: "en", value: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", }, ], metrics: [ { other: { content: { namespace: "https://access.redhat.com/security/updates/classification/", value: "Moderate", }, type: "Red Hat severity rating", }, }, { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, format: "CVSS", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-476", description: "NULL Pointer Dereference", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-11-24T14:18:46.173Z", orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", shortName: "redhat", }, references: [ { name: "RHSA-2024:1834", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { name: "RHSA-2024:1835", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { name: "RHSA-2024:1873", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { name: "RHSA-2024:1876", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { name: "RHSA-2024:1883", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { name: "RHSA-2024:1902", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { name: "RHSA-2024:1903", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { name: "RHSA-2024:1959", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { name: "RHSA-2024:2086", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { tags: [ "vdb-entry", "x_refsource_REDHAT", ], url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { name: "RHBZ#2241796", tags: [ "issue-tracking", "x_refsource_REDHAT", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, ], timeline: [ { lang: "en", time: "2023-10-02T00:00:00+00:00", value: "Reported to Red Hat.", }, { lang: "en", time: "2024-01-23T00:00:00+00:00", value: "Made public.", }, ], title: "Shim: out-of-bounds read printing error messages", workarounds: [ { lang: "en", value: "There's no available mitigation for this issue.", }, ], x_redhatCweChain: "CWE-476: NULL Pointer Dereference", }, }, cveMetadata: { assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", assignerShortName: "redhat", cveId: "CVE-2023-40546", datePublished: "2024-01-29T16:29:26.258Z", dateReserved: "2023-08-15T20:04:15.615Z", dateUpdated: "2024-11-24T14:18:46.173Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { fkie_nvd: { configurations: "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:shim:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"15.8\", \"matchCriteriaId\": \"01639865-3664-4034-BCFB-F4E09AF37F28\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F4CFF558-3C47-480D-A2F0-BABF26042943\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F6FB57C-2BC7-487C-96DD-132683AEB35D\"}]}]}]", descriptions: "[{\"lang\": \"en\", \"value\": \"A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.\"}, {\"lang\": \"es\", \"value\": \"Se encontr\\u00f3 un fallo en Shim cuando ocurri\\u00f3 un error al crear una nueva variable ESL. Si Shim no puede crear la nueva variable, intenta imprimir un mensaje de error para el usuario; sin embargo, la cantidad de par\\u00e1metros utilizados por la funci\\u00f3n de registro no coincide con la cadena de formato utilizada, lo que provoca un bloqueo en determinadas circunstancias.\"}]", id: "CVE-2023-40546", lastModified: "2024-11-21T08:19:41.450", metrics: "{\"cvssMetricV31\": [{\"source\": \"secalert@redhat.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 6.2, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.5, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}", published: "2024-01-29T17:15:08.347", references: "[{\"url\": \"https://access.redhat.com/errata/RHSA-2024:1834\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1835\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1873\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1876\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1883\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1902\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1903\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1959\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:2086\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2023-40546\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2241796\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1834\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1835\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1873\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1876\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1883\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1902\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1903\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:1959\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:2086\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2023-40546\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2241796\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/05/msg00009.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]", sourceIdentifier: "secalert@redhat.com", vulnStatus: "Modified", weaknesses: "[{\"source\": \"secalert@redhat.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]", }, nvd: "{\"cve\":{\"id\":\"CVE-2023-40546\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2024-01-29T17:15:08.347\",\"lastModified\":\"2024-11-21T08:19:41.450\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.\"},{\"lang\":\"es\",\"value\":\"Se encontró un fallo en Shim cuando ocurrió un error al crear una nueva variable ESL. Si Shim no puede crear la nueva variable, intenta imprimir un mensaje de error para el usuario; sin embargo, la cantidad de parámetros utilizados por la función de registro no coincide con la cadena de formato utilizada, lo que provoca un bloqueo en determinadas circunstancias.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:shim:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"15.8\",\"matchCriteriaId\":\"01639865-3664-4034-BCFB-F4E09AF37F28\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F6FB57C-2BC7-487C-96DD-132683AEB35D\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1834\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1835\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1873\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1876\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1883\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1902\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1903\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1959\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:2086\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2023-40546\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2241796\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1834\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1835\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1873\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1876\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1883\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1902\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1903\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:1959\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:2086\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2023-40546\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2241796\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/05/msg00009.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}", }, }
rhsa-2024_1834
Vulnerability from csaf_redhat
Published
2024-04-16 13:38
Modified
2024-11-24 14:19
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.2 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.2 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1834", url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1834.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:19:40+00:00", generator: { date: "2024-11-24T14:19:40+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1834", initial_release_date: "2024-04-16T13:38:02+00:00", revision_history: [ { date: "2024-04-16T13:38:02+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-16T13:38:02+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:19:40+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product: { name: "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.AUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_aus:8.2::baseos", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product: { name: "Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product_id: "BaseOS-8.2.0.Z.E4S", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_e4s:8.2::baseos", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product: { name: "Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.TUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_tus:8.2::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-2.el8_2.src", product: { name: "shim-0:15.8-2.el8_2.src", product_id: "shim-0:15.8-2.el8_2.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-2.el8_2?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-ia32-0:15.8-2.el8_2.x86_64", product: { name: "shim-ia32-0:15.8-2.el8_2.x86_64", product_id: "shim-ia32-0:15.8-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-2.el8_2?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-2.el8_2.x86_64", product: { name: "shim-x64-0:15.8-2.el8_2.x86_64", product_id: "shim-x64-0:15.8-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-2.el8_2?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_2.src as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", }, product_reference: "shim-0:15.8-2.el8_2.src", relates_to_product_reference: "BaseOS-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_2.src as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product_id: "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", }, product_reference: "shim-0:15.8-2.el8_2.src", relates_to_product_reference: "BaseOS-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product_id: "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product_id: "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_2.src as a component of Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", }, product_reference: "shim-0:15.8-2.el8_2.src", relates_to_product_reference: "BaseOS-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.TUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024:1902
Vulnerability from csaf_redhat
Published
2024-04-18 17:44
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1902", url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1902.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:20:20+00:00", generator: { date: "2024-11-24T14:20:20+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1902", initial_release_date: "2024-04-18T17:44:10+00:00", revision_history: [ { date: "2024-04-18T17:44:10+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T17:44:10+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:20+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS (v. 8)", product: { name: "Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:8::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-4.el8_9.src", product: { name: "shim-0:15.8-4.el8_9.src", product_id: "shim-0:15.8-4.el8_9.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-4.el8_9?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-4.el8_9.aarch64", product: { name: "shim-aa64-0:15.8-4.el8_9.aarch64", product_id: "shim-aa64-0:15.8-4.el8_9.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-4.el8_9?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-ia32-0:15.8-4.el8_9.x86_64", product: { name: "shim-ia32-0:15.8-4.el8_9.x86_64", product_id: "shim-ia32-0:15.8-4.el8_9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-4.el8_9?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-4.el8_9.x86_64", product: { name: "shim-x64-0:15.8-4.el8_9.x86_64", product_id: "shim-x64-0:15.8-4.el8_9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-4.el8_9?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-4.el8_9.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", }, product_reference: "shim-0:15.8-4.el8_9.src", relates_to_product_reference: "BaseOS-8.9.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-4.el8_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", }, product_reference: "shim-aa64-0:15.8-4.el8_9.aarch64", relates_to_product_reference: "BaseOS-8.9.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-4.el8_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", }, product_reference: "shim-ia32-0:15.8-4.el8_9.x86_64", relates_to_product_reference: "BaseOS-8.9.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-4.el8_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", }, product_reference: "shim-x64-0:15.8-4.el8_9.x86_64", relates_to_product_reference: "BaseOS-8.9.0.Z.MAIN", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024_1883
Vulnerability from csaf_redhat
Published
2024-04-18 01:56
Modified
2024-11-24 14:19
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.8 Extended
Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.8 Extended\nUpdate Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1883", url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1883.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:19:51+00:00", generator: { date: "2024-11-24T14:19:51+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1883", initial_release_date: "2024-04-18T01:56:22+00:00", revision_history: [ { date: "2024-04-18T01:56:22+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T01:56:22+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:19:51+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat CodeReady Linux Builder EUS (v.8.8)", product: { name: "Red Hat CodeReady Linux Builder EUS (v.8.8)", product_id: "CRB-8.8.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:8.8::crb", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product: { name: "Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_eus:8.8::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-unsigned-x64-0:15.8-2.el8.src", product: { name: "shim-unsigned-x64-0:15.8-2.el8.src", product_id: "shim-unsigned-x64-0:15.8-2.el8.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el8?arch=src", }, }, }, { category: "product_version", name: "shim-0:15.8-2.el8.src", product: { name: "shim-0:15.8-2.el8.src", product_id: "shim-0:15.8-2.el8.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-2.el8?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-unsigned-x64-0:15.8-2.el8.x86_64", product: { name: "shim-unsigned-x64-0:15.8-2.el8.x86_64", product_id: "shim-unsigned-x64-0:15.8-2.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el8?arch=x86_64", }, }, }, { category: "product_version", name: "shim-ia32-0:15.8-2.el8.x86_64", product: { name: "shim-ia32-0:15.8-2.el8.x86_64", product_id: "shim-ia32-0:15.8-2.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-2.el8?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-2.el8.x86_64", product: { name: "shim-x64-0:15.8-2.el8.x86_64", product_id: "shim-x64-0:15.8-2.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-2.el8?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-2.el8.aarch64", product: { name: "shim-aa64-0:15.8-2.el8.aarch64", product_id: "shim-aa64-0:15.8-2.el8.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-2.el8?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", }, product_reference: "shim-0:15.8-2.el8.src", relates_to_product_reference: "BaseOS-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", }, product_reference: "shim-aa64-0:15.8-2.el8.aarch64", relates_to_product_reference: "BaseOS-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8.x86_64", relates_to_product_reference: "BaseOS-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8.x86_64", relates_to_product_reference: "BaseOS-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-2.el8.src as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)", product_id: "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", }, product_reference: "shim-unsigned-x64-0:15.8-2.el8.src", relates_to_product_reference: "CRB-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-2.el8.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)", product_id: "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-2.el8.x86_64", relates_to_product_reference: "CRB-8.8.0.Z.EUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024_1873
Vulnerability from csaf_redhat
Published
2024-04-18 01:42
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, E4S Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, E4S Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1873", url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1873.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:20:11+00:00", generator: { date: "2024-11-24T14:20:11+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1873", initial_release_date: "2024-04-18T01:42:32+00:00", revision_history: [ { date: "2024-04-18T01:42:32+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T01:42:32+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:11+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product: { name: "Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.AUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_aus:8.4::baseos", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product: { name: "Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product_id: "BaseOS-8.4.0.Z.E4S", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_e4s:8.4::baseos", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product: { name: "Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.TUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_tus:8.4::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-2.el8_4.src", product: { name: "shim-0:15.8-2.el8_4.src", product_id: "shim-0:15.8-2.el8_4.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-2.el8_4?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-ia32-0:15.8-2.el8_4.x86_64", product: { name: "shim-ia32-0:15.8-2.el8_4.x86_64", product_id: "shim-ia32-0:15.8-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-2.el8_4?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-2.el8_4.x86_64", product: { name: "shim-x64-0:15.8-2.el8_4.x86_64", product_id: "shim-x64-0:15.8-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-2.el8_4?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_4.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", }, product_reference: "shim-0:15.8-2.el8_4.src", relates_to_product_reference: "BaseOS-8.4.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_4.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product_id: "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", }, product_reference: "shim-0:15.8-2.el8_4.src", relates_to_product_reference: "BaseOS-8.4.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product_id: "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product_id: "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_4.src as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", }, product_reference: "shim-0:15.8-2.el8_4.src", relates_to_product_reference: "BaseOS-8.4.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.TUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024:1959
Vulnerability from csaf_redhat
Published
2024-04-23 01:00
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
IMPORTANT: The new shim revokes ALL VERSIONS of GRUB2 before grub2-2.02-0.87.el7_9.14. Therefore GRUB2 MUST be updated to the latest
version: grub2-2.02-0.87.el7_9.14 BEFORE or SIMULTANEOUSLY with this shim in order for Secure Boot to continue to work. Failure to update GRUB2 will result in an UNBOOTABLE system.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nIMPORTANT: The new shim revokes ALL VERSIONS of GRUB2 before grub2-2.02-0.87.el7_9.14. Therefore GRUB2 MUST be updated to the latest\nversion: grub2-2.02-0.87.el7_9.14 BEFORE or SIMULTANEOUSLY with this shim in order for Secure Boot to continue to work. Failure to update GRUB2 will result in an UNBOOTABLE system.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1959", url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "RHEL-2155", url: "https://issues.redhat.com/browse/RHEL-2155", }, { category: "external", summary: "RHEL-4382", url: "https://issues.redhat.com/browse/RHEL-4382", }, { category: "external", summary: "RHEL-4390", url: "https://issues.redhat.com/browse/RHEL-4390", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1959.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:20:40+00:00", generator: { date: "2024-11-24T14:20:40+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1959", initial_release_date: "2024-04-23T01:00:12+00:00", revision_history: [ { date: "2024-04-23T01:00:12+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-23T01:00:12+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:40+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Client (v. 7)", product: { name: "Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::client", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Server (v. 7)", product: { name: "Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::server", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Workstation (v. 7)", product: { name: "Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::workstation", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-3.el7.src", product: { name: "shim-0:15.8-3.el7.src", product_id: "shim-0:15.8-3.el7.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-3.el7?arch=src", }, }, }, { category: "product_version", name: "shim-signed-0:15.8-1.el7.src", product: { name: "shim-signed-0:15.8-1.el7.src", product_id: "shim-signed-0:15.8-1.el7.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim-signed@15.8-1.el7?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", product: { name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", product_id: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-ia32@15.8-3.el7?arch=x86_64", }, }, }, { category: "product_version", name: "shim-unsigned-x64-0:15.8-3.el7.x86_64", product: { name: "shim-unsigned-x64-0:15.8-3.el7.x86_64", product_id: "shim-unsigned-x64-0:15.8-3.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-3.el7?arch=x86_64", }, }, }, { category: "product_version", name: "mokutil-0:15.8-1.el7.x86_64", product: { name: "mokutil-0:15.8-1.el7.x86_64", product_id: "mokutil-0:15.8-1.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mokutil@15.8-1.el7?arch=x86_64", }, }, }, { category: "product_version", name: "shim-ia32-0:15.8-1.el7.x86_64", product: { name: "shim-ia32-0:15.8-1.el7.x86_64", product_id: "shim-ia32-0:15.8-1.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-1.el7?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-1.el7.x86_64", product: { name: "shim-x64-0:15.8-1.el7.x86_64", product_id: "shim-x64-0:15.8-1.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-1.el7?arch=x86_64", }, }, }, { category: "product_version", name: "mokutil-debuginfo-0:15.8-1.el7.x86_64", product: { name: "mokutil-debuginfo-0:15.8-1.el7.x86_64", product_id: "mokutil-debuginfo-0:15.8-1.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mokutil-debuginfo@15.8-1.el7?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "mokutil-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-debuginfo-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-debuginfo-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-0:15.8-3.el7.src", }, product_reference: "shim-0:15.8-3.el7.src", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", }, product_reference: "shim-ia32-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-signed-0:15.8-1.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", }, product_reference: "shim-signed-0:15.8-1.el7.src", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", }, product_reference: "shim-x64-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-debuginfo-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-debuginfo-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-0:15.8-3.el7.src", }, product_reference: "shim-0:15.8-3.el7.src", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", }, product_reference: "shim-ia32-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-signed-0:15.8-1.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", }, product_reference: "shim-signed-0:15.8-1.el7.src", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", }, product_reference: "shim-x64-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-debuginfo-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-debuginfo-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", }, product_reference: "shim-0:15.8-3.el7.src", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", }, product_reference: "shim-ia32-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-signed-0:15.8-1.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", }, product_reference: "shim-signed-0:15.8-1.el7.src", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", }, product_reference: "shim-x64-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
RHSA-2024:1876
Vulnerability from csaf_redhat
Published
2024-04-18 01:47
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim bug fix update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1876", url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1876.json", }, ], title: "Red Hat Security Advisory: shim bug fix update", tracking: { current_release_date: "2024-11-24T14:20:01+00:00", generator: { date: "2024-11-24T14:20:01+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1876", initial_release_date: "2024-04-18T01:47:33+00:00", revision_history: [ { date: "2024-04-18T01:47:33+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T01:47:33+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:01+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product: { name: "Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product_id: "BaseOS-9.2.0.Z.EUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_eus:9.2::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-3.el9_2.src", product: { name: "shim-0:15.8-3.el9_2.src", product_id: "shim-0:15.8-3.el9_2.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-3.el9_2?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-3.el9_2.aarch64", product: { name: "shim-aa64-0:15.8-3.el9_2.aarch64", product_id: "shim-aa64-0:15.8-3.el9_2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-3.el9_2?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-x64-0:15.8-3.el9_2.x86_64", product: { name: "shim-x64-0:15.8-3.el9_2.x86_64", product_id: "shim-x64-0:15.8-3.el9_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-3.el9_2?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el9_2.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product_id: "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", }, product_reference: "shim-0:15.8-3.el9_2.src", relates_to_product_reference: "BaseOS-9.2.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-3.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product_id: "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", }, product_reference: "shim-aa64-0:15.8-3.el9_2.aarch64", relates_to_product_reference: "BaseOS-9.2.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-3.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product_id: "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", }, product_reference: "shim-x64-0:15.8-3.el9_2.x86_64", relates_to_product_reference: "BaseOS-9.2.0.Z.EUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024_1903
Vulnerability from csaf_redhat
Published
2024-04-18 17:42
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim bug fix update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1903", url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1903.json", }, ], title: "Red Hat Security Advisory: shim bug fix update", tracking: { current_release_date: "2024-11-24T14:20:31+00:00", generator: { date: "2024-11-24T14:20:31+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1903", initial_release_date: "2024-04-18T17:42:35+00:00", revision_history: [ { date: "2024-04-18T17:42:35+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T17:42:35+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:31+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS (v. 9)", product: { name: "Red Hat Enterprise Linux BaseOS (v. 9)", product_id: "BaseOS-9.3.0.Z.MAIN", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:9::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-4.el9_3.src", product: { name: "shim-0:15.8-4.el9_3.src", product_id: "shim-0:15.8-4.el9_3.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-4.el9_3?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-4.el9_3.aarch64", product: { name: "shim-aa64-0:15.8-4.el9_3.aarch64", product_id: "shim-aa64-0:15.8-4.el9_3.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-4.el9_3?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-x64-0:15.8-4.el9_3.x86_64", product: { name: "shim-x64-0:15.8-4.el9_3.x86_64", product_id: "shim-x64-0:15.8-4.el9_3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-4.el9_3?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-4.el9_3.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)", product_id: "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", }, product_reference: "shim-0:15.8-4.el9_3.src", relates_to_product_reference: "BaseOS-9.3.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-4.el9_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", product_id: "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", }, product_reference: "shim-aa64-0:15.8-4.el9_3.aarch64", relates_to_product_reference: "BaseOS-9.3.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-4.el9_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", product_id: "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", }, product_reference: "shim-x64-0:15.8-4.el9_3.x86_64", relates_to_product_reference: "BaseOS-9.3.0.Z.MAIN", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
RHSA-2024:1903
Vulnerability from csaf_redhat
Published
2024-04-18 17:42
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim bug fix update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1903", url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1903.json", }, ], title: "Red Hat Security Advisory: shim bug fix update", tracking: { current_release_date: "2024-11-24T14:20:31+00:00", generator: { date: "2024-11-24T14:20:31+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1903", initial_release_date: "2024-04-18T17:42:35+00:00", revision_history: [ { date: "2024-04-18T17:42:35+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T17:42:35+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:31+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS (v. 9)", product: { name: "Red Hat Enterprise Linux BaseOS (v. 9)", product_id: "BaseOS-9.3.0.Z.MAIN", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:9::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-4.el9_3.src", product: { name: "shim-0:15.8-4.el9_3.src", product_id: "shim-0:15.8-4.el9_3.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-4.el9_3?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-4.el9_3.aarch64", product: { name: "shim-aa64-0:15.8-4.el9_3.aarch64", product_id: "shim-aa64-0:15.8-4.el9_3.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-4.el9_3?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-x64-0:15.8-4.el9_3.x86_64", product: { name: "shim-x64-0:15.8-4.el9_3.x86_64", product_id: "shim-x64-0:15.8-4.el9_3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-4.el9_3?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-4.el9_3.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)", product_id: "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", }, product_reference: "shim-0:15.8-4.el9_3.src", relates_to_product_reference: "BaseOS-9.3.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-4.el9_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", product_id: "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", }, product_reference: "shim-aa64-0:15.8-4.el9_3.aarch64", relates_to_product_reference: "BaseOS-9.3.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-4.el9_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", product_id: "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", }, product_reference: "shim-x64-0:15.8-4.el9_3.x86_64", relates_to_product_reference: "BaseOS-9.3.0.Z.MAIN", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024_1902
Vulnerability from csaf_redhat
Published
2024-04-18 17:44
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1902", url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1902.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:20:20+00:00", generator: { date: "2024-11-24T14:20:20+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1902", initial_release_date: "2024-04-18T17:44:10+00:00", revision_history: [ { date: "2024-04-18T17:44:10+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T17:44:10+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:20+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS (v. 8)", product: { name: "Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:8::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-4.el8_9.src", product: { name: "shim-0:15.8-4.el8_9.src", product_id: "shim-0:15.8-4.el8_9.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-4.el8_9?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-4.el8_9.aarch64", product: { name: "shim-aa64-0:15.8-4.el8_9.aarch64", product_id: "shim-aa64-0:15.8-4.el8_9.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-4.el8_9?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-ia32-0:15.8-4.el8_9.x86_64", product: { name: "shim-ia32-0:15.8-4.el8_9.x86_64", product_id: "shim-ia32-0:15.8-4.el8_9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-4.el8_9?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-4.el8_9.x86_64", product: { name: "shim-x64-0:15.8-4.el8_9.x86_64", product_id: "shim-x64-0:15.8-4.el8_9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-4.el8_9?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-4.el8_9.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", }, product_reference: "shim-0:15.8-4.el8_9.src", relates_to_product_reference: "BaseOS-8.9.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-4.el8_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", }, product_reference: "shim-aa64-0:15.8-4.el8_9.aarch64", relates_to_product_reference: "BaseOS-8.9.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-4.el8_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", }, product_reference: "shim-ia32-0:15.8-4.el8_9.x86_64", relates_to_product_reference: "BaseOS-8.9.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-4.el8_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", }, product_reference: "shim-x64-0:15.8-4.el8_9.x86_64", relates_to_product_reference: "BaseOS-8.9.0.Z.MAIN", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
RHSA-2024:1959
Vulnerability from csaf_redhat
Published
2024-04-23 01:00
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
IMPORTANT: The new shim revokes ALL VERSIONS of GRUB2 before grub2-2.02-0.87.el7_9.14. Therefore GRUB2 MUST be updated to the latest
version: grub2-2.02-0.87.el7_9.14 BEFORE or SIMULTANEOUSLY with this shim in order for Secure Boot to continue to work. Failure to update GRUB2 will result in an UNBOOTABLE system.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nIMPORTANT: The new shim revokes ALL VERSIONS of GRUB2 before grub2-2.02-0.87.el7_9.14. Therefore GRUB2 MUST be updated to the latest\nversion: grub2-2.02-0.87.el7_9.14 BEFORE or SIMULTANEOUSLY with this shim in order for Secure Boot to continue to work. Failure to update GRUB2 will result in an UNBOOTABLE system.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1959", url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "RHEL-2155", url: "https://issues.redhat.com/browse/RHEL-2155", }, { category: "external", summary: "RHEL-4382", url: "https://issues.redhat.com/browse/RHEL-4382", }, { category: "external", summary: "RHEL-4390", url: "https://issues.redhat.com/browse/RHEL-4390", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1959.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:20:40+00:00", generator: { date: "2024-11-24T14:20:40+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1959", initial_release_date: "2024-04-23T01:00:12+00:00", revision_history: [ { date: "2024-04-23T01:00:12+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-23T01:00:12+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:40+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Client (v. 7)", product: { name: "Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::client", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Server (v. 7)", product: { name: "Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::server", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Workstation (v. 7)", product: { name: "Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::workstation", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-3.el7.src", product: { name: "shim-0:15.8-3.el7.src", product_id: "shim-0:15.8-3.el7.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-3.el7?arch=src", }, }, }, { category: "product_version", name: "shim-signed-0:15.8-1.el7.src", product: { name: "shim-signed-0:15.8-1.el7.src", product_id: "shim-signed-0:15.8-1.el7.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim-signed@15.8-1.el7?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", product: { name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", product_id: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-ia32@15.8-3.el7?arch=x86_64", }, }, }, { category: "product_version", name: "shim-unsigned-x64-0:15.8-3.el7.x86_64", product: { name: "shim-unsigned-x64-0:15.8-3.el7.x86_64", product_id: "shim-unsigned-x64-0:15.8-3.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-3.el7?arch=x86_64", }, }, }, { category: "product_version", name: "mokutil-0:15.8-1.el7.x86_64", product: { name: "mokutil-0:15.8-1.el7.x86_64", product_id: "mokutil-0:15.8-1.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mokutil@15.8-1.el7?arch=x86_64", }, }, }, { category: "product_version", name: "shim-ia32-0:15.8-1.el7.x86_64", product: { name: "shim-ia32-0:15.8-1.el7.x86_64", product_id: "shim-ia32-0:15.8-1.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-1.el7?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-1.el7.x86_64", product: { name: "shim-x64-0:15.8-1.el7.x86_64", product_id: "shim-x64-0:15.8-1.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-1.el7?arch=x86_64", }, }, }, { category: "product_version", name: "mokutil-debuginfo-0:15.8-1.el7.x86_64", product: { name: "mokutil-debuginfo-0:15.8-1.el7.x86_64", product_id: "mokutil-debuginfo-0:15.8-1.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mokutil-debuginfo@15.8-1.el7?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "mokutil-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-debuginfo-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-debuginfo-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-0:15.8-3.el7.src", }, product_reference: "shim-0:15.8-3.el7.src", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", }, product_reference: "shim-ia32-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-signed-0:15.8-1.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", }, product_reference: "shim-signed-0:15.8-1.el7.src", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", }, product_reference: "shim-x64-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-debuginfo-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-debuginfo-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-0:15.8-3.el7.src", }, product_reference: "shim-0:15.8-3.el7.src", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", }, product_reference: "shim-ia32-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-signed-0:15.8-1.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", }, product_reference: "shim-signed-0:15.8-1.el7.src", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", }, product_reference: "shim-x64-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-debuginfo-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-debuginfo-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", }, product_reference: "shim-0:15.8-3.el7.src", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", }, product_reference: "shim-ia32-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-signed-0:15.8-1.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", }, product_reference: "shim-signed-0:15.8-1.el7.src", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", }, product_reference: "shim-x64-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
RHSA-2024:1883
Vulnerability from csaf_redhat
Published
2024-04-18 01:56
Modified
2024-11-24 14:19
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.8 Extended
Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.8 Extended\nUpdate Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1883", url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1883.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:19:51+00:00", generator: { date: "2024-11-24T14:19:51+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1883", initial_release_date: "2024-04-18T01:56:22+00:00", revision_history: [ { date: "2024-04-18T01:56:22+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T01:56:22+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:19:51+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat CodeReady Linux Builder EUS (v.8.8)", product: { name: "Red Hat CodeReady Linux Builder EUS (v.8.8)", product_id: "CRB-8.8.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:8.8::crb", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product: { name: "Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_eus:8.8::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-unsigned-x64-0:15.8-2.el8.src", product: { name: "shim-unsigned-x64-0:15.8-2.el8.src", product_id: "shim-unsigned-x64-0:15.8-2.el8.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el8?arch=src", }, }, }, { category: "product_version", name: "shim-0:15.8-2.el8.src", product: { name: "shim-0:15.8-2.el8.src", product_id: "shim-0:15.8-2.el8.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-2.el8?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-unsigned-x64-0:15.8-2.el8.x86_64", product: { name: "shim-unsigned-x64-0:15.8-2.el8.x86_64", product_id: "shim-unsigned-x64-0:15.8-2.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el8?arch=x86_64", }, }, }, { category: "product_version", name: "shim-ia32-0:15.8-2.el8.x86_64", product: { name: "shim-ia32-0:15.8-2.el8.x86_64", product_id: "shim-ia32-0:15.8-2.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-2.el8?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-2.el8.x86_64", product: { name: "shim-x64-0:15.8-2.el8.x86_64", product_id: "shim-x64-0:15.8-2.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-2.el8?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-2.el8.aarch64", product: { name: "shim-aa64-0:15.8-2.el8.aarch64", product_id: "shim-aa64-0:15.8-2.el8.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-2.el8?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", }, product_reference: "shim-0:15.8-2.el8.src", relates_to_product_reference: "BaseOS-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", }, product_reference: "shim-aa64-0:15.8-2.el8.aarch64", relates_to_product_reference: "BaseOS-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8.x86_64", relates_to_product_reference: "BaseOS-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8.x86_64", relates_to_product_reference: "BaseOS-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-2.el8.src as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)", product_id: "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", }, product_reference: "shim-unsigned-x64-0:15.8-2.el8.src", relates_to_product_reference: "CRB-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-2.el8.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)", product_id: "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-2.el8.x86_64", relates_to_product_reference: "CRB-8.8.0.Z.EUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024_1876
Vulnerability from csaf_redhat
Published
2024-04-18 01:47
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim bug fix update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1876", url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1876.json", }, ], title: "Red Hat Security Advisory: shim bug fix update", tracking: { current_release_date: "2024-11-24T14:20:01+00:00", generator: { date: "2024-11-24T14:20:01+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1876", initial_release_date: "2024-04-18T01:47:33+00:00", revision_history: [ { date: "2024-04-18T01:47:33+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T01:47:33+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:01+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product: { name: "Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product_id: "BaseOS-9.2.0.Z.EUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_eus:9.2::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-3.el9_2.src", product: { name: "shim-0:15.8-3.el9_2.src", product_id: "shim-0:15.8-3.el9_2.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-3.el9_2?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-3.el9_2.aarch64", product: { name: "shim-aa64-0:15.8-3.el9_2.aarch64", product_id: "shim-aa64-0:15.8-3.el9_2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-3.el9_2?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-x64-0:15.8-3.el9_2.x86_64", product: { name: "shim-x64-0:15.8-3.el9_2.x86_64", product_id: "shim-x64-0:15.8-3.el9_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-3.el9_2?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el9_2.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product_id: "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", }, product_reference: "shim-0:15.8-3.el9_2.src", relates_to_product_reference: "BaseOS-9.2.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-3.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product_id: "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", }, product_reference: "shim-aa64-0:15.8-3.el9_2.aarch64", relates_to_product_reference: "BaseOS-9.2.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-3.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product_id: "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", }, product_reference: "shim-x64-0:15.8-3.el9_2.x86_64", relates_to_product_reference: "BaseOS-9.2.0.Z.EUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
RHSA-2024:1873
Vulnerability from csaf_redhat
Published
2024-04-18 01:42
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, E4S Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, E4S Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1873", url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1873.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:20:11+00:00", generator: { date: "2024-11-24T14:20:11+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1873", initial_release_date: "2024-04-18T01:42:32+00:00", revision_history: [ { date: "2024-04-18T01:42:32+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T01:42:32+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:11+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product: { name: "Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.AUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_aus:8.4::baseos", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product: { name: "Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product_id: "BaseOS-8.4.0.Z.E4S", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_e4s:8.4::baseos", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product: { name: "Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.TUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_tus:8.4::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-2.el8_4.src", product: { name: "shim-0:15.8-2.el8_4.src", product_id: "shim-0:15.8-2.el8_4.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-2.el8_4?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-ia32-0:15.8-2.el8_4.x86_64", product: { name: "shim-ia32-0:15.8-2.el8_4.x86_64", product_id: "shim-ia32-0:15.8-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-2.el8_4?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-2.el8_4.x86_64", product: { name: "shim-x64-0:15.8-2.el8_4.x86_64", product_id: "shim-x64-0:15.8-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-2.el8_4?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_4.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", }, product_reference: "shim-0:15.8-2.el8_4.src", relates_to_product_reference: "BaseOS-8.4.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_4.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product_id: "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", }, product_reference: "shim-0:15.8-2.el8_4.src", relates_to_product_reference: "BaseOS-8.4.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product_id: "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product_id: "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_4.src as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", }, product_reference: "shim-0:15.8-2.el8_4.src", relates_to_product_reference: "BaseOS-8.4.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.TUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024:1876
Vulnerability from csaf_redhat
Published
2024-04-18 01:47
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim bug fix update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1876", url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1876.json", }, ], title: "Red Hat Security Advisory: shim bug fix update", tracking: { current_release_date: "2024-11-24T14:20:01+00:00", generator: { date: "2024-11-24T14:20:01+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1876", initial_release_date: "2024-04-18T01:47:33+00:00", revision_history: [ { date: "2024-04-18T01:47:33+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T01:47:33+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:01+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product: { name: "Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product_id: "BaseOS-9.2.0.Z.EUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_eus:9.2::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-3.el9_2.src", product: { name: "shim-0:15.8-3.el9_2.src", product_id: "shim-0:15.8-3.el9_2.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-3.el9_2?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-3.el9_2.aarch64", product: { name: "shim-aa64-0:15.8-3.el9_2.aarch64", product_id: "shim-aa64-0:15.8-3.el9_2.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-3.el9_2?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-x64-0:15.8-3.el9_2.x86_64", product: { name: "shim-x64-0:15.8-3.el9_2.x86_64", product_id: "shim-x64-0:15.8-3.el9_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-3.el9_2?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el9_2.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product_id: "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", }, product_reference: "shim-0:15.8-3.el9_2.src", relates_to_product_reference: "BaseOS-9.2.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-3.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product_id: "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", }, product_reference: "shim-aa64-0:15.8-3.el9_2.aarch64", relates_to_product_reference: "BaseOS-9.2.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-3.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)", product_id: "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", }, product_reference: "shim-x64-0:15.8-3.el9_2.x86_64", relates_to_product_reference: "BaseOS-9.2.0.Z.EUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:47:33+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1876", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.2.0.Z.EUS:shim-0:15.8-3.el9_2.src", "BaseOS-9.2.0.Z.EUS:shim-aa64-0:15.8-3.el9_2.aarch64", "BaseOS-9.2.0.Z.EUS:shim-x64-0:15.8-3.el9_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
RHSA-2024:1835
Vulnerability from csaf_redhat
Published
2024-04-16 13:45
Modified
2024-11-24 14:19
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1835", url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1835.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:19:30+00:00", generator: { date: "2024-11-24T14:19:30+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1835", initial_release_date: "2024-04-16T13:45:47+00:00", revision_history: [ { date: "2024-04-16T13:45:47+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-16T13:45:47+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:19:30+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream EUS (v.9.0)", product: { name: "Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:9.0::appstream", }, }, }, { category: "product_name", name: "Red Hat CodeReady Linux Builder EUS (v.9.0)", product: { name: "Red Hat CodeReady Linux Builder EUS (v.9.0)", product_id: "CRB-9.0.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:9.0::crb", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product: { name: "Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product_id: "BaseOS-9.0.0.Z.EUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_eus:9.0::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-unsigned-aarch64-0:15.8-2.el9.src", product: { name: "shim-unsigned-aarch64-0:15.8-2.el9.src", product_id: "shim-unsigned-aarch64-0:15.8-2.el9.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-aarch64@15.8-2.el9?arch=src", }, }, }, { category: "product_version", name: "shim-unsigned-x64-0:15.8-2.el9.src", product: { name: "shim-unsigned-x64-0:15.8-2.el9.src", product_id: "shim-unsigned-x64-0:15.8-2.el9.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el9?arch=src", }, }, }, { category: "product_version", name: "shim-0:15.8-3.el9.src", product: { name: "shim-0:15.8-3.el9.src", product_id: "shim-0:15.8-3.el9.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-3.el9?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64", product: { name: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64", product_id: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-aarch64@15.8-2.el9?arch=aarch64", }, }, }, { category: "product_version", name: "shim-aa64-0:15.8-3.el9.aarch64", product: { name: "shim-aa64-0:15.8-3.el9.aarch64", product_id: "shim-aa64-0:15.8-3.el9.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-3.el9?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-unsigned-x64-0:15.8-2.el9.x86_64", product: { name: "shim-unsigned-x64-0:15.8-2.el9.x86_64", product_id: "shim-unsigned-x64-0:15.8-2.el9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el9?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-3.el9.x86_64", product: { name: "shim-x64-0:15.8-3.el9.x86_64", product_id: "shim-x64-0:15.8-3.el9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-3.el9?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", }, product_reference: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-aarch64-0:15.8-2.el9.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", }, product_reference: "shim-unsigned-aarch64-0:15.8-2.el9.src", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el9.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product_id: "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", }, product_reference: "shim-0:15.8-3.el9.src", relates_to_product_reference: "BaseOS-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-3.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product_id: "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", }, product_reference: "shim-aa64-0:15.8-3.el9.aarch64", relates_to_product_reference: "BaseOS-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-3.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product_id: "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", }, product_reference: "shim-x64-0:15.8-3.el9.x86_64", relates_to_product_reference: "BaseOS-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-2.el9.src as a component of Red Hat CodeReady Linux Builder EUS (v.9.0)", product_id: "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", }, product_reference: "shim-unsigned-x64-0:15.8-2.el9.src", relates_to_product_reference: "CRB-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-2.el9.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.0)", product_id: "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-2.el9.x86_64", relates_to_product_reference: "CRB-9.0.0.Z.EUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
RHSA-2024:2086
Vulnerability from csaf_redhat
Published
2024-04-29 12:31
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.6 Extended
Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.6 Extended\nUpdate Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:2086", url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2086.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:20:50+00:00", generator: { date: "2024-11-24T14:20:50+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:2086", initial_release_date: "2024-04-29T12:31:44+00:00", revision_history: [ { date: "2024-04-29T12:31:44+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-29T12:31:44+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:50+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product: { name: "Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_eus:8.6::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-2.el8_6.src", product: { name: "shim-0:15.8-2.el8_6.src", product_id: "shim-0:15.8-2.el8_6.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-2.el8_6?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-2.el8_6.aarch64", product: { name: "shim-aa64-0:15.8-2.el8_6.aarch64", product_id: "shim-aa64-0:15.8-2.el8_6.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-2.el8_6?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-ia32-0:15.8-2.el8_6.x86_64", product: { name: "shim-ia32-0:15.8-2.el8_6.x86_64", product_id: "shim-ia32-0:15.8-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-2.el8_6?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-2.el8_6.x86_64", product: { name: "shim-x64-0:15.8-2.el8_6.x86_64", product_id: "shim-x64-0:15.8-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-2.el8_6?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_6.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", }, product_reference: "shim-0:15.8-2.el8_6.src", relates_to_product_reference: "BaseOS-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", }, product_reference: "shim-aa64-0:15.8-2.el8_6.aarch64", relates_to_product_reference: "BaseOS-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_6.x86_64", relates_to_product_reference: "BaseOS-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_6.x86_64", relates_to_product_reference: "BaseOS-8.6.0.Z.EUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024:1883
Vulnerability from csaf_redhat
Published
2024-04-18 01:56
Modified
2024-11-24 14:19
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.8 Extended
Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.8 Extended\nUpdate Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1883", url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1883.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:19:51+00:00", generator: { date: "2024-11-24T14:19:51+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1883", initial_release_date: "2024-04-18T01:56:22+00:00", revision_history: [ { date: "2024-04-18T01:56:22+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T01:56:22+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:19:51+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat CodeReady Linux Builder EUS (v.8.8)", product: { name: "Red Hat CodeReady Linux Builder EUS (v.8.8)", product_id: "CRB-8.8.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:8.8::crb", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product: { name: "Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_eus:8.8::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-unsigned-x64-0:15.8-2.el8.src", product: { name: "shim-unsigned-x64-0:15.8-2.el8.src", product_id: "shim-unsigned-x64-0:15.8-2.el8.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el8?arch=src", }, }, }, { category: "product_version", name: "shim-0:15.8-2.el8.src", product: { name: "shim-0:15.8-2.el8.src", product_id: "shim-0:15.8-2.el8.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-2.el8?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-unsigned-x64-0:15.8-2.el8.x86_64", product: { name: "shim-unsigned-x64-0:15.8-2.el8.x86_64", product_id: "shim-unsigned-x64-0:15.8-2.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el8?arch=x86_64", }, }, }, { category: "product_version", name: "shim-ia32-0:15.8-2.el8.x86_64", product: { name: "shim-ia32-0:15.8-2.el8.x86_64", product_id: "shim-ia32-0:15.8-2.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-2.el8?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-2.el8.x86_64", product: { name: "shim-x64-0:15.8-2.el8.x86_64", product_id: "shim-x64-0:15.8-2.el8.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-2.el8?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-2.el8.aarch64", product: { name: "shim-aa64-0:15.8-2.el8.aarch64", product_id: "shim-aa64-0:15.8-2.el8.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-2.el8?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", }, product_reference: "shim-0:15.8-2.el8.src", relates_to_product_reference: "BaseOS-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", }, product_reference: "shim-aa64-0:15.8-2.el8.aarch64", relates_to_product_reference: "BaseOS-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8.x86_64", relates_to_product_reference: "BaseOS-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)", product_id: "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8.x86_64", relates_to_product_reference: "BaseOS-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-2.el8.src as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)", product_id: "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", }, product_reference: "shim-unsigned-x64-0:15.8-2.el8.src", relates_to_product_reference: "CRB-8.8.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-2.el8.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)", product_id: "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-2.el8.x86_64", relates_to_product_reference: "CRB-8.8.0.Z.EUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:56:22+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1883", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.8.0.Z.EUS:shim-0:15.8-2.el8.src", "BaseOS-8.8.0.Z.EUS:shim-aa64-0:15.8-2.el8.aarch64", "BaseOS-8.8.0.Z.EUS:shim-ia32-0:15.8-2.el8.x86_64", "BaseOS-8.8.0.Z.EUS:shim-x64-0:15.8-2.el8.x86_64", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.src", "CRB-8.8.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el8.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024:1903
Vulnerability from csaf_redhat
Published
2024-04-18 17:42
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim bug fix update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1903", url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1903.json", }, ], title: "Red Hat Security Advisory: shim bug fix update", tracking: { current_release_date: "2024-11-24T14:20:31+00:00", generator: { date: "2024-11-24T14:20:31+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1903", initial_release_date: "2024-04-18T17:42:35+00:00", revision_history: [ { date: "2024-04-18T17:42:35+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T17:42:35+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:31+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS (v. 9)", product: { name: "Red Hat Enterprise Linux BaseOS (v. 9)", product_id: "BaseOS-9.3.0.Z.MAIN", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:9::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-4.el9_3.src", product: { name: "shim-0:15.8-4.el9_3.src", product_id: "shim-0:15.8-4.el9_3.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-4.el9_3?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-4.el9_3.aarch64", product: { name: "shim-aa64-0:15.8-4.el9_3.aarch64", product_id: "shim-aa64-0:15.8-4.el9_3.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-4.el9_3?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-x64-0:15.8-4.el9_3.x86_64", product: { name: "shim-x64-0:15.8-4.el9_3.x86_64", product_id: "shim-x64-0:15.8-4.el9_3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-4.el9_3?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-4.el9_3.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)", product_id: "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", }, product_reference: "shim-0:15.8-4.el9_3.src", relates_to_product_reference: "BaseOS-9.3.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-4.el9_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", product_id: "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", }, product_reference: "shim-aa64-0:15.8-4.el9_3.aarch64", relates_to_product_reference: "BaseOS-9.3.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-4.el9_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", product_id: "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", }, product_reference: "shim-x64-0:15.8-4.el9_3.x86_64", relates_to_product_reference: "BaseOS-9.3.0.Z.MAIN", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:42:35+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1903", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-9.3.0.Z.MAIN:shim-0:15.8-4.el9_3.src", "BaseOS-9.3.0.Z.MAIN:shim-aa64-0:15.8-4.el9_3.aarch64", "BaseOS-9.3.0.Z.MAIN:shim-x64-0:15.8-4.el9_3.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024_1835
Vulnerability from csaf_redhat
Published
2024-04-16 13:45
Modified
2024-11-24 14:19
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1835", url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1835.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:19:30+00:00", generator: { date: "2024-11-24T14:19:30+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1835", initial_release_date: "2024-04-16T13:45:47+00:00", revision_history: [ { date: "2024-04-16T13:45:47+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-16T13:45:47+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:19:30+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream EUS (v.9.0)", product: { name: "Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:9.0::appstream", }, }, }, { category: "product_name", name: "Red Hat CodeReady Linux Builder EUS (v.9.0)", product: { name: "Red Hat CodeReady Linux Builder EUS (v.9.0)", product_id: "CRB-9.0.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:9.0::crb", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product: { name: "Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product_id: "BaseOS-9.0.0.Z.EUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_eus:9.0::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-unsigned-aarch64-0:15.8-2.el9.src", product: { name: "shim-unsigned-aarch64-0:15.8-2.el9.src", product_id: "shim-unsigned-aarch64-0:15.8-2.el9.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-aarch64@15.8-2.el9?arch=src", }, }, }, { category: "product_version", name: "shim-unsigned-x64-0:15.8-2.el9.src", product: { name: "shim-unsigned-x64-0:15.8-2.el9.src", product_id: "shim-unsigned-x64-0:15.8-2.el9.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el9?arch=src", }, }, }, { category: "product_version", name: "shim-0:15.8-3.el9.src", product: { name: "shim-0:15.8-3.el9.src", product_id: "shim-0:15.8-3.el9.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-3.el9?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64", product: { name: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64", product_id: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-aarch64@15.8-2.el9?arch=aarch64", }, }, }, { category: "product_version", name: "shim-aa64-0:15.8-3.el9.aarch64", product: { name: "shim-aa64-0:15.8-3.el9.aarch64", product_id: "shim-aa64-0:15.8-3.el9.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-3.el9?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-unsigned-x64-0:15.8-2.el9.x86_64", product: { name: "shim-unsigned-x64-0:15.8-2.el9.x86_64", product_id: "shim-unsigned-x64-0:15.8-2.el9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el9?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-3.el9.x86_64", product: { name: "shim-x64-0:15.8-3.el9.x86_64", product_id: "shim-x64-0:15.8-3.el9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-3.el9?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", }, product_reference: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-aarch64-0:15.8-2.el9.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", }, product_reference: "shim-unsigned-aarch64-0:15.8-2.el9.src", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el9.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product_id: "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", }, product_reference: "shim-0:15.8-3.el9.src", relates_to_product_reference: "BaseOS-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-3.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product_id: "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", }, product_reference: "shim-aa64-0:15.8-3.el9.aarch64", relates_to_product_reference: "BaseOS-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-3.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product_id: "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", }, product_reference: "shim-x64-0:15.8-3.el9.x86_64", relates_to_product_reference: "BaseOS-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-2.el9.src as a component of Red Hat CodeReady Linux Builder EUS (v.9.0)", product_id: "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", }, product_reference: "shim-unsigned-x64-0:15.8-2.el9.src", relates_to_product_reference: "CRB-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-2.el9.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.0)", product_id: "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-2.el9.x86_64", relates_to_product_reference: "CRB-9.0.0.Z.EUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
RHSA-2024:1902
Vulnerability from csaf_redhat
Published
2024-04-18 17:44
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1902", url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1902.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:20:20+00:00", generator: { date: "2024-11-24T14:20:20+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1902", initial_release_date: "2024-04-18T17:44:10+00:00", revision_history: [ { date: "2024-04-18T17:44:10+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T17:44:10+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:20+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS (v. 8)", product: { name: "Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:8::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-4.el8_9.src", product: { name: "shim-0:15.8-4.el8_9.src", product_id: "shim-0:15.8-4.el8_9.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-4.el8_9?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-4.el8_9.aarch64", product: { name: "shim-aa64-0:15.8-4.el8_9.aarch64", product_id: "shim-aa64-0:15.8-4.el8_9.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-4.el8_9?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-ia32-0:15.8-4.el8_9.x86_64", product: { name: "shim-ia32-0:15.8-4.el8_9.x86_64", product_id: "shim-ia32-0:15.8-4.el8_9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-4.el8_9?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-4.el8_9.x86_64", product: { name: "shim-x64-0:15.8-4.el8_9.x86_64", product_id: "shim-x64-0:15.8-4.el8_9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-4.el8_9?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-4.el8_9.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", }, product_reference: "shim-0:15.8-4.el8_9.src", relates_to_product_reference: "BaseOS-8.9.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-4.el8_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", }, product_reference: "shim-aa64-0:15.8-4.el8_9.aarch64", relates_to_product_reference: "BaseOS-8.9.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-4.el8_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", }, product_reference: "shim-ia32-0:15.8-4.el8_9.x86_64", relates_to_product_reference: "BaseOS-8.9.0.Z.MAIN", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-4.el8_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", product_id: "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", }, product_reference: "shim-x64-0:15.8-4.el8_9.x86_64", relates_to_product_reference: "BaseOS-8.9.0.Z.MAIN", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T17:44:10+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1902", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.9.0.Z.MAIN:shim-0:15.8-4.el8_9.src", "BaseOS-8.9.0.Z.MAIN:shim-aa64-0:15.8-4.el8_9.aarch64", "BaseOS-8.9.0.Z.MAIN:shim-ia32-0:15.8-4.el8_9.x86_64", "BaseOS-8.9.0.Z.MAIN:shim-x64-0:15.8-4.el8_9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024_2086
Vulnerability from csaf_redhat
Published
2024-04-29 12:31
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.6 Extended
Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.6 Extended\nUpdate Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:2086", url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2086.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:20:50+00:00", generator: { date: "2024-11-24T14:20:50+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:2086", initial_release_date: "2024-04-29T12:31:44+00:00", revision_history: [ { date: "2024-04-29T12:31:44+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-29T12:31:44+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:50+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product: { name: "Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_eus:8.6::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-2.el8_6.src", product: { name: "shim-0:15.8-2.el8_6.src", product_id: "shim-0:15.8-2.el8_6.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-2.el8_6?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-2.el8_6.aarch64", product: { name: "shim-aa64-0:15.8-2.el8_6.aarch64", product_id: "shim-aa64-0:15.8-2.el8_6.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-2.el8_6?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-ia32-0:15.8-2.el8_6.x86_64", product: { name: "shim-ia32-0:15.8-2.el8_6.x86_64", product_id: "shim-ia32-0:15.8-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-2.el8_6?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-2.el8_6.x86_64", product: { name: "shim-x64-0:15.8-2.el8_6.x86_64", product_id: "shim-x64-0:15.8-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-2.el8_6?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_6.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", }, product_reference: "shim-0:15.8-2.el8_6.src", relates_to_product_reference: "BaseOS-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", }, product_reference: "shim-aa64-0:15.8-2.el8_6.aarch64", relates_to_product_reference: "BaseOS-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_6.x86_64", relates_to_product_reference: "BaseOS-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_6.x86_64", relates_to_product_reference: "BaseOS-8.6.0.Z.EUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024:1873
Vulnerability from csaf_redhat
Published
2024-04-18 01:42
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, E4S Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, E4S Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1873", url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1873.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:20:11+00:00", generator: { date: "2024-11-24T14:20:11+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1873", initial_release_date: "2024-04-18T01:42:32+00:00", revision_history: [ { date: "2024-04-18T01:42:32+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-18T01:42:32+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:11+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product: { name: "Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.AUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_aus:8.4::baseos", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product: { name: "Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product_id: "BaseOS-8.4.0.Z.E4S", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_e4s:8.4::baseos", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product: { name: "Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.TUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_tus:8.4::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-2.el8_4.src", product: { name: "shim-0:15.8-2.el8_4.src", product_id: "shim-0:15.8-2.el8_4.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-2.el8_4?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-ia32-0:15.8-2.el8_4.x86_64", product: { name: "shim-ia32-0:15.8-2.el8_4.x86_64", product_id: "shim-ia32-0:15.8-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-2.el8_4?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-2.el8_4.x86_64", product: { name: "shim-x64-0:15.8-2.el8_4.x86_64", product_id: "shim-x64-0:15.8-2.el8_4.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-2.el8_4?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_4.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", }, product_reference: "shim-0:15.8-2.el8_4.src", relates_to_product_reference: "BaseOS-8.4.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_4.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product_id: "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", }, product_reference: "shim-0:15.8-2.el8_4.src", relates_to_product_reference: "BaseOS-8.4.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product_id: "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)", product_id: "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_4.src as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", }, product_reference: "shim-0:15.8-2.el8_4.src", relates_to_product_reference: "BaseOS-8.4.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)", product_id: "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_4.x86_64", relates_to_product_reference: "BaseOS-8.4.0.Z.TUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-18T01:42:32+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1873", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.4.0.Z.AUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.AUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.AUS:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.E4S:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.E4S:shim-x64-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-0:15.8-2.el8_4.src", "BaseOS-8.4.0.Z.TUS:shim-ia32-0:15.8-2.el8_4.x86_64", "BaseOS-8.4.0.Z.TUS:shim-x64-0:15.8-2.el8_4.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024:1834
Vulnerability from csaf_redhat
Published
2024-04-16 13:38
Modified
2024-11-24 14:19
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.2 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.2 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1834", url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1834.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:19:40+00:00", generator: { date: "2024-11-24T14:19:40+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1834", initial_release_date: "2024-04-16T13:38:02+00:00", revision_history: [ { date: "2024-04-16T13:38:02+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-16T13:38:02+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:19:40+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product: { name: "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.AUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_aus:8.2::baseos", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product: { name: "Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product_id: "BaseOS-8.2.0.Z.E4S", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_e4s:8.2::baseos", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product: { name: "Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.TUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_tus:8.2::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-2.el8_2.src", product: { name: "shim-0:15.8-2.el8_2.src", product_id: "shim-0:15.8-2.el8_2.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-2.el8_2?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-ia32-0:15.8-2.el8_2.x86_64", product: { name: "shim-ia32-0:15.8-2.el8_2.x86_64", product_id: "shim-ia32-0:15.8-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-2.el8_2?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-2.el8_2.x86_64", product: { name: "shim-x64-0:15.8-2.el8_2.x86_64", product_id: "shim-x64-0:15.8-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-2.el8_2?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_2.src as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", }, product_reference: "shim-0:15.8-2.el8_2.src", relates_to_product_reference: "BaseOS-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_2.src as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product_id: "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", }, product_reference: "shim-0:15.8-2.el8_2.src", relates_to_product_reference: "BaseOS-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product_id: "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product_id: "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_2.src as a component of Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", }, product_reference: "shim-0:15.8-2.el8_2.src", relates_to_product_reference: "BaseOS-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.TUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024:2086
Vulnerability from csaf_redhat
Published
2024-04-29 12:31
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.6 Extended
Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section
on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file
(CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.6 Extended\nUpdate Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section\non 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file\n(CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:2086", url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2086.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:20:50+00:00", generator: { date: "2024-11-24T14:20:50+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:2086", initial_release_date: "2024-04-29T12:31:44+00:00", revision_history: [ { date: "2024-04-29T12:31:44+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-29T12:31:44+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:50+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product: { name: "Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_eus:8.6::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-2.el8_6.src", product: { name: "shim-0:15.8-2.el8_6.src", product_id: "shim-0:15.8-2.el8_6.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-2.el8_6?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-aa64-0:15.8-2.el8_6.aarch64", product: { name: "shim-aa64-0:15.8-2.el8_6.aarch64", product_id: "shim-aa64-0:15.8-2.el8_6.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-2.el8_6?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-ia32-0:15.8-2.el8_6.x86_64", product: { name: "shim-ia32-0:15.8-2.el8_6.x86_64", product_id: "shim-ia32-0:15.8-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-2.el8_6?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-2.el8_6.x86_64", product: { name: "shim-x64-0:15.8-2.el8_6.x86_64", product_id: "shim-x64-0:15.8-2.el8_6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-2.el8_6?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_6.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", }, product_reference: "shim-0:15.8-2.el8_6.src", relates_to_product_reference: "BaseOS-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", }, product_reference: "shim-aa64-0:15.8-2.el8_6.aarch64", relates_to_product_reference: "BaseOS-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_6.x86_64", relates_to_product_reference: "BaseOS-8.6.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)", product_id: "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_6.x86_64", relates_to_product_reference: "BaseOS-8.6.0.Z.EUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-29T12:31:44+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:2086", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.6.0.Z.EUS:shim-0:15.8-2.el8_6.src", "BaseOS-8.6.0.Z.EUS:shim-aa64-0:15.8-2.el8_6.aarch64", "BaseOS-8.6.0.Z.EUS:shim-ia32-0:15.8-2.el8_6.x86_64", "BaseOS-8.6.0.Z.EUS:shim-x64-0:15.8-2.el8_6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
RHSA-2024:1834
Vulnerability from csaf_redhat
Published
2024-04-16 13:38
Modified
2024-11-24 14:19
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.2 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.2 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1834", url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1834.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:19:40+00:00", generator: { date: "2024-11-24T14:19:40+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1834", initial_release_date: "2024-04-16T13:38:02+00:00", revision_history: [ { date: "2024-04-16T13:38:02+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-16T13:38:02+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:19:40+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product: { name: "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.AUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_aus:8.2::baseos", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product: { name: "Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product_id: "BaseOS-8.2.0.Z.E4S", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_e4s:8.2::baseos", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product: { name: "Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.TUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_tus:8.2::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-2.el8_2.src", product: { name: "shim-0:15.8-2.el8_2.src", product_id: "shim-0:15.8-2.el8_2.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-2.el8_2?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-ia32-0:15.8-2.el8_2.x86_64", product: { name: "shim-ia32-0:15.8-2.el8_2.x86_64", product_id: "shim-ia32-0:15.8-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-2.el8_2?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-2.el8_2.x86_64", product: { name: "shim-x64-0:15.8-2.el8_2.x86_64", product_id: "shim-x64-0:15.8-2.el8_2.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-2.el8_2?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_2.src as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", }, product_reference: "shim-0:15.8-2.el8_2.src", relates_to_product_reference: "BaseOS-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.AUS", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_2.src as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product_id: "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", }, product_reference: "shim-0:15.8-2.el8_2.src", relates_to_product_reference: "BaseOS-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product_id: "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.2)", product_id: "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.E4S", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-2.el8_2.src as a component of Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", }, product_reference: "shim-0:15.8-2.el8_2.src", relates_to_product_reference: "BaseOS-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-ia32-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.TUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v. 8.2)", product_id: "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", }, product_reference: "shim-x64-0:15.8-2.el8_2.x86_64", relates_to_product_reference: "BaseOS-8.2.0.Z.TUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:38:02+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1834", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "BaseOS-8.2.0.Z.AUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.AUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.AUS:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.E4S:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.E4S:shim-x64-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-0:15.8-2.el8_2.src", "BaseOS-8.2.0.Z.TUS:shim-ia32-0:15.8-2.el8_2.x86_64", "BaseOS-8.2.0.Z.TUS:shim-x64-0:15.8-2.el8_2.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024:1835
Vulnerability from csaf_redhat
Published
2024-04-16 13:45
Modified
2024-11-24 14:19
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1835", url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1835.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:19:30+00:00", generator: { date: "2024-11-24T14:19:30+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1835", initial_release_date: "2024-04-16T13:45:47+00:00", revision_history: [ { date: "2024-04-16T13:45:47+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-16T13:45:47+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:19:30+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AppStream EUS (v.9.0)", product: { name: "Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:9.0::appstream", }, }, }, { category: "product_name", name: "Red Hat CodeReady Linux Builder EUS (v.9.0)", product: { name: "Red Hat CodeReady Linux Builder EUS (v.9.0)", product_id: "CRB-9.0.0.Z.EUS", product_identification_helper: { cpe: "cpe:/a:redhat:rhel_eus:9.0::crb", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product: { name: "Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product_id: "BaseOS-9.0.0.Z.EUS", product_identification_helper: { cpe: "cpe:/o:redhat:rhel_eus:9.0::baseos", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-unsigned-aarch64-0:15.8-2.el9.src", product: { name: "shim-unsigned-aarch64-0:15.8-2.el9.src", product_id: "shim-unsigned-aarch64-0:15.8-2.el9.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-aarch64@15.8-2.el9?arch=src", }, }, }, { category: "product_version", name: "shim-unsigned-x64-0:15.8-2.el9.src", product: { name: "shim-unsigned-x64-0:15.8-2.el9.src", product_id: "shim-unsigned-x64-0:15.8-2.el9.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el9?arch=src", }, }, }, { category: "product_version", name: "shim-0:15.8-3.el9.src", product: { name: "shim-0:15.8-3.el9.src", product_id: "shim-0:15.8-3.el9.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-3.el9?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64", product: { name: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64", product_id: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-aarch64@15.8-2.el9?arch=aarch64", }, }, }, { category: "product_version", name: "shim-aa64-0:15.8-3.el9.aarch64", product: { name: "shim-aa64-0:15.8-3.el9.aarch64", product_id: "shim-aa64-0:15.8-3.el9.aarch64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-aa64@15.8-3.el9?arch=aarch64", }, }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "shim-unsigned-x64-0:15.8-2.el9.x86_64", product: { name: "shim-unsigned-x64-0:15.8-2.el9.x86_64", product_id: "shim-unsigned-x64-0:15.8-2.el9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-2.el9?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-3.el9.x86_64", product: { name: "shim-x64-0:15.8-3.el9.x86_64", product_id: "shim-x64-0:15.8-3.el9.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-3.el9?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", }, product_reference: "shim-unsigned-aarch64-0:15.8-2.el9.aarch64", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-aarch64-0:15.8-2.el9.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.0)", product_id: "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", }, product_reference: "shim-unsigned-aarch64-0:15.8-2.el9.src", relates_to_product_reference: "AppStream-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el9.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product_id: "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", }, product_reference: "shim-0:15.8-3.el9.src", relates_to_product_reference: "BaseOS-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-aa64-0:15.8-3.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product_id: "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", }, product_reference: "shim-aa64-0:15.8-3.el9.aarch64", relates_to_product_reference: "BaseOS-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-3.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)", product_id: "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", }, product_reference: "shim-x64-0:15.8-3.el9.x86_64", relates_to_product_reference: "BaseOS-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-2.el9.src as a component of Red Hat CodeReady Linux Builder EUS (v.9.0)", product_id: "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", }, product_reference: "shim-unsigned-x64-0:15.8-2.el9.src", relates_to_product_reference: "CRB-9.0.0.Z.EUS", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-2.el9.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.0)", product_id: "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-2.el9.x86_64", relates_to_product_reference: "CRB-9.0.0.Z.EUS", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-16T13:45:47+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to: \n\nhttps://access.redhat.com/articles/11258", product_ids: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1835", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.aarch64", "AppStream-9.0.0.Z.EUS:shim-unsigned-aarch64-0:15.8-2.el9.src", "BaseOS-9.0.0.Z.EUS:shim-0:15.8-3.el9.src", "BaseOS-9.0.0.Z.EUS:shim-aa64-0:15.8-3.el9.aarch64", "BaseOS-9.0.0.Z.EUS:shim-x64-0:15.8-3.el9.x86_64", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.src", "CRB-9.0.0.Z.EUS:shim-unsigned-x64-0:15.8-2.el9.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
rhsa-2024_1959
Vulnerability from csaf_redhat
Published
2024-04-23 01:00
Modified
2024-11-24 14:20
Summary
Red Hat Security Advisory: shim security update
Notes
Topic
An update for shim is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The shim package contains a first-stage UEFI boot loader that handles chaining
to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
IMPORTANT: The new shim revokes ALL VERSIONS of GRUB2 before grub2-2.02-0.87.el7_9.14. Therefore GRUB2 MUST be updated to the latest
version: grub2-2.02-0.87.el7_9.14 BEFORE or SIMULTANEOUSLY with this shim in order for Secure Boot to continue to work. Failure to update GRUB2 will result in an UNBOOTABLE system.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for shim is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The shim package contains a first-stage UEFI boot loader that handles chaining\nto a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)\n\n* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)\n\n* shim: Out-of-bounds read printing error messages (CVE-2023-40546)\n\n* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)\n\n* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)\n\n* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nIMPORTANT: The new shim revokes ALL VERSIONS of GRUB2 before grub2-2.02-0.87.el7_9.14. Therefore GRUB2 MUST be updated to the latest\nversion: grub2-2.02-0.87.el7_9.14 BEFORE or SIMULTANEOUSLY with this shim in order for Secure Boot to continue to work. Failure to update GRUB2 will result in an UNBOOTABLE system.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2024:1959", url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "RHEL-2155", url: "https://issues.redhat.com/browse/RHEL-2155", }, { category: "external", summary: "RHEL-4382", url: "https://issues.redhat.com/browse/RHEL-4382", }, { category: "external", summary: "RHEL-4390", url: "https://issues.redhat.com/browse/RHEL-4390", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1959.json", }, ], title: "Red Hat Security Advisory: shim security update", tracking: { current_release_date: "2024-11-24T14:20:40+00:00", generator: { date: "2024-11-24T14:20:40+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2024:1959", initial_release_date: "2024-04-23T01:00:12+00:00", revision_history: [ { date: "2024-04-23T01:00:12+00:00", number: "1", summary: "Initial version", }, { date: "2024-04-23T01:00:12+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-24T14:20:40+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Client (v. 7)", product: { name: "Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::client", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Server (v. 7)", product: { name: "Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::server", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Workstation (v. 7)", product: { name: "Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::workstation", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "shim-0:15.8-3.el7.src", product: { name: "shim-0:15.8-3.el7.src", product_id: "shim-0:15.8-3.el7.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim@15.8-3.el7?arch=src", }, }, }, { category: "product_version", name: "shim-signed-0:15.8-1.el7.src", product: { name: "shim-signed-0:15.8-1.el7.src", product_id: "shim-signed-0:15.8-1.el7.src", product_identification_helper: { purl: "pkg:rpm/redhat/shim-signed@15.8-1.el7?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", product: { name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", product_id: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-ia32@15.8-3.el7?arch=x86_64", }, }, }, { category: "product_version", name: "shim-unsigned-x64-0:15.8-3.el7.x86_64", product: { name: "shim-unsigned-x64-0:15.8-3.el7.x86_64", product_id: "shim-unsigned-x64-0:15.8-3.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-unsigned-x64@15.8-3.el7?arch=x86_64", }, }, }, { category: "product_version", name: "mokutil-0:15.8-1.el7.x86_64", product: { name: "mokutil-0:15.8-1.el7.x86_64", product_id: "mokutil-0:15.8-1.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mokutil@15.8-1.el7?arch=x86_64", }, }, }, { category: "product_version", name: "shim-ia32-0:15.8-1.el7.x86_64", product: { name: "shim-ia32-0:15.8-1.el7.x86_64", product_id: "shim-ia32-0:15.8-1.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-ia32@15.8-1.el7?arch=x86_64", }, }, }, { category: "product_version", name: "shim-x64-0:15.8-1.el7.x86_64", product: { name: "shim-x64-0:15.8-1.el7.x86_64", product_id: "shim-x64-0:15.8-1.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/shim-x64@15.8-1.el7?arch=x86_64", }, }, }, { category: "product_version", name: "mokutil-debuginfo-0:15.8-1.el7.x86_64", product: { name: "mokutil-debuginfo-0:15.8-1.el7.x86_64", product_id: "mokutil-debuginfo-0:15.8-1.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mokutil-debuginfo@15.8-1.el7?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "mokutil-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-debuginfo-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-debuginfo-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-0:15.8-3.el7.src", }, product_reference: "shim-0:15.8-3.el7.src", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", }, product_reference: "shim-ia32-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-signed-0:15.8-1.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", }, product_reference: "shim-signed-0:15.8-1.el7.src", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", product_id: "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", }, product_reference: "shim-x64-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Client-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-debuginfo-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-debuginfo-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-0:15.8-3.el7.src", }, product_reference: "shim-0:15.8-3.el7.src", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", }, product_reference: "shim-ia32-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-signed-0:15.8-1.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", }, product_reference: "shim-signed-0:15.8-1.el7.src", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", product_id: "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", }, product_reference: "shim-x64-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Server-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "mokutil-debuginfo-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", }, product_reference: "mokutil-debuginfo-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-0:15.8-3.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", }, product_reference: "shim-0:15.8-3.el7.src", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-ia32-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", }, product_reference: "shim-ia32-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-signed-0:15.8-1.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", }, product_reference: "shim-signed-0:15.8-1.el7.src", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-ia32-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-ia32-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-unsigned-x64-0:15.8-3.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", }, product_reference: "shim-unsigned-x64-0:15.8-3.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, { category: "default_component_of", full_product_name: { name: "shim-x64-0:15.8-1.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", product_id: "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", }, product_reference: "shim-x64-0:15.8-1.el7.x86_64", relates_to_product_reference: "7Workstation-7.9.Z", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", cwe: { id: "CWE-476", name: "NULL Pointer Dereference", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241796", }, ], notes: [ { category: "description", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read printing error messages", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "RHBZ#2241796", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40546", url: "https://www.cve.org/CVERecord?id=CVE-2023-40546", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read printing error messages", }, { acknowledgments: [ { names: [ "Bill Demirkapi", ], organization: "Microsoft Security Response Center", }, ], cve: "CVE-2023-40547", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-05-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2234589", }, ], notes: [ { category: "description", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "Vulnerability description", }, { category: "summary", text: "shim: RCE in http boot support may lead to Secure Boot bypass", title: "Vulnerability summary", }, { category: "other", text: "This flaw is only exploitable when the machine is booting UEFI through the network. During startup, before loading a local boot image, Shim checks whether the system is configured to support network booting. If the check succeeds, Shim attempts to load the bootable image from the boot's previously configured server using the HTTP protocol, which exposes the system to the vulnerability described by this CVE.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "RHBZ#2234589", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2234589", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40547", url: "https://www.cve.org/CVERecord?id=CVE-2023-40547", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40547", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "workaround", details: "If a system isn’t required to boot from the network, configure the server’s boot order to disable entirely or skip the network boot.", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "shim: RCE in http boot support may lead to Secure Boot bypass", }, { cve: "CVE-2023-40548", cwe: { id: "CWE-787", name: "Out-of-bounds Write", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241782", }, ], notes: [ { category: "description", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "RHBZ#2241782", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241782", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40548", url: "https://www.cve.org/CVERecord?id=CVE-2023-40548", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40548", }, ], release_date: "2023-10-03T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.4, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems", }, { cve: "CVE-2023-40549", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-10-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2241797", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "RHBZ#2241797", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241797", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40549", url: "https://www.cve.org/CVERecord?id=CVE-2023-40549", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40549", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "workaround", details: "There's no available mitigation for this issue.", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file", }, { cve: "CVE-2023-40550", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2024-01-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259915", }, ], notes: [ { category: "description", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: Out-of-bound read in verify_buffer_sbat()", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "RHBZ#2259915", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259915", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40550", url: "https://www.cve.org/CVERecord?id=CVE-2023-40550", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40550", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: Out-of-bound read in verify_buffer_sbat()", }, { cve: "CVE-2023-40551", cwe: { id: "CWE-125", name: "Out-of-bounds Read", }, discovery_date: "2023-07-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "2259918", }, ], notes: [ { category: "description", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "Vulnerability description", }, { category: "summary", text: "shim: out of bounds read when parsing MZ binaries", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "RHBZ#2259918", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2259918", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-40551", url: "https://www.cve.org/CVERecord?id=CVE-2023-40551", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40551", }, ], release_date: "2024-01-23T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2024-04-23T01:00:12+00:00", details: "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2024:1959", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "7Client-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Client-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-0:15.8-3.el7.src", "7Client-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Client-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Client-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Client-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Server-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-0:15.8-3.el7.src", "7Server-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Server-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Server-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Server-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:mokutil-debuginfo-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-0:15.8-3.el7.src", "7Workstation-7.9.Z:shim-ia32-0:15.8-1.el7.x86_64", "7Workstation-7.9.Z:shim-signed-0:15.8-1.el7.src", "7Workstation-7.9.Z:shim-unsigned-ia32-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-unsigned-x64-0:15.8-3.el7.x86_64", "7Workstation-7.9.Z:shim-x64-0:15.8-1.el7.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "shim: out of bounds read when parsing MZ binaries", }, ], }
wid-sec-w-2024-1313
Vulnerability from csaf_certbund
Published
2024-06-06 22:00
Modified
2024-12-01 23:00
Summary
IBM QRadar SIEM: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
IBM QRadar Security Information and Event Management (SIEM) bietet Unterstützung bei der Erkennung und Priorisierung von Sicherheitsbedrohungen im Unternehmen.
Angriff
Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Dateien zu manipulieren, um einen Denial-of-Service-Zustand erzuegen, um vertrauliche Informationen offenzulegen, um die Sicherheitsmaßnahmen zu umgehen und beliebigen Code auszuführen.
Betroffene Betriebssysteme
- Linux
{ document: { aggregate_severity: { text: "hoch", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "IBM QRadar Security Information and Event Management (SIEM) bietet Unterstützung bei der Erkennung und Priorisierung von Sicherheitsbedrohungen im Unternehmen.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Dateien zu manipulieren, um einen Denial-of-Service-Zustand erzuegen, um vertrauliche Informationen offenzulegen, um die Sicherheitsmaßnahmen zu umgehen und beliebigen Code auszuführen.", title: "Angriff", }, { category: "general", text: "- Linux", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2024-1313 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1313.json", }, { category: "self", summary: "WID-SEC-2024-1313 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1313", }, { category: "external", summary: "IBM Security Bulletin vom 2024-06-06", url: "https://www.ibm.com/support/pages/node/7156667", }, ], source_lang: "en-US", title: "IBM QRadar SIEM: Mehrere Schwachstellen", tracking: { current_release_date: "2024-12-01T23:00:00.000+00:00", generator: { date: "2024-12-02T11:03:55.226+00:00", engine: { name: "BSI-WID", version: "1.3.8", }, }, id: "WID-SEC-W-2024-1313", initial_release_date: "2024-06-06T22:00:00.000+00:00", revision_history: [ { date: "2024-06-06T22:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, { date: "2024-12-01T23:00:00.000+00:00", number: "2", summary: "Korrektur Plattformauswahl", }, ], status: "final", version: "2", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version_range", name: "<7.5.0 UP8 IF03", product: { name: "IBM QRadar SIEM <7.5.0 UP8 IF03", product_id: "T035249", }, }, { category: "product_version", name: "7.5.0 UP8 IF03", product: { name: "IBM QRadar SIEM 7.5.0 UP8 IF03", product_id: "T035249-fixed", product_identification_helper: { cpe: "cpe:/a:ibm:qradar_siem:7.5.0_up8_if03", }, }, }, ], category: "product_name", name: "QRadar SIEM", }, ], category: "vendor", name: "IBM", }, ], }, vulnerabilities: [ { cve: "CVE-2024-22243", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen. Diese Fehler betreffen das VMware Tanzu Spring Framework aufgrund eines offenen Redirects in UriComponentsBuilder. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Phising-Angriff durchzuführen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2024-22243", }, { cve: "CVE-2024-22259", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen. Diese Fehler betreffen das VMware Tanzu Spring Framework aufgrund eines offenen Redirects in UriComponentsBuilder. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Phising-Angriff durchzuführen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2024-22259", }, { cve: "CVE-2024-22262", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen. Diese Fehler betreffen das VMware Tanzu Spring Framework aufgrund eines offenen Redirects in UriComponentsBuilder. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Phising-Angriff durchzuführen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2024-22262", }, { cve: "CVE-2023-40546", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in den Komponenten ISC BIND und rhboot shim. Diese bestehen aufgrund unsachgemäßem Parsing, Fehlern bei der Antwortverarbeitung, einer NULL-Zeiger-Dereferenz und einem Out-of-Bounds-Read-Fehler. Ein entfernter, anonymer oder ein lokaler, privilegierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-40546", }, { cve: "CVE-2023-40549", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in den Komponenten ISC BIND und rhboot shim. Diese bestehen aufgrund unsachgemäßem Parsing, Fehlern bei der Antwortverarbeitung, einer NULL-Zeiger-Dereferenz und einem Out-of-Bounds-Read-Fehler. Ein entfernter, anonymer oder ein lokaler, privilegierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-40549", }, { cve: "CVE-2023-40551", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in den Komponenten ISC BIND und rhboot shim. Diese bestehen aufgrund unsachgemäßem Parsing, Fehlern bei der Antwortverarbeitung, einer NULL-Zeiger-Dereferenz und einem Out-of-Bounds-Read-Fehler. Ein entfernter, anonymer oder ein lokaler, privilegierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-40551", }, { cve: "CVE-2023-4408", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in den Komponenten ISC BIND und rhboot shim. Diese bestehen aufgrund unsachgemäßem Parsing, Fehlern bei der Antwortverarbeitung, einer NULL-Zeiger-Dereferenz und einem Out-of-Bounds-Read-Fehler. Ein entfernter, anonymer oder ein lokaler, privilegierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-4408", }, { cve: "CVE-2023-50387", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in den Komponenten ISC BIND und rhboot shim. Diese bestehen aufgrund unsachgemäßem Parsing, Fehlern bei der Antwortverarbeitung, einer NULL-Zeiger-Dereferenz und einem Out-of-Bounds-Read-Fehler. Ein entfernter, anonymer oder ein lokaler, privilegierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-50387", }, { cve: "CVE-2023-50868", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in den Komponenten ISC BIND und rhboot shim. Diese bestehen aufgrund unsachgemäßem Parsing, Fehlern bei der Antwortverarbeitung, einer NULL-Zeiger-Dereferenz und einem Out-of-Bounds-Read-Fehler. Ein entfernter, anonymer oder ein lokaler, privilegierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-50868", }, { cve: "CVE-2023-40547", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen. Diese Fehler bestehen in rhboot-Shim aufgrund eines Out-of-Bounds-Write und eines Heap-basierten Pufferüberlaufs. Ein Angreifer aus einem angrenzenden Netzwerk oder ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-40547", }, { cve: "CVE-2023-40548", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen. Diese Fehler bestehen in rhboot-Shim aufgrund eines Out-of-Bounds-Write und eines Heap-basierten Pufferüberlaufs. Ein Angreifer aus einem angrenzenden Netzwerk oder ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-40548", }, { cve: "CVE-2023-40550", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen. Diese Fehler besteht in rhboot-Shim aufgrund eines Out-of-Bound-Lesefehlers in der Funktion verify_buffer_sbat(). Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-40550", }, { cve: "CVE-2023-3758", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in der SSSD-Komponente. Die GPO-Richtlinie für authentifizierte Benutzer wird nicht konsistent angewendet. Ein Angreifer aus einem angrenzenden Netzwerk kann diese Schwachstelle ausnutzen, um Sicherheitsmaßnahmen bzgl. Autorisierung zu umgehen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-3758", }, ], }
WID-SEC-W-2024-1313
Vulnerability from csaf_certbund
Published
2024-06-06 22:00
Modified
2024-12-01 23:00
Summary
IBM QRadar SIEM: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
IBM QRadar Security Information and Event Management (SIEM) bietet Unterstützung bei der Erkennung und Priorisierung von Sicherheitsbedrohungen im Unternehmen.
Angriff
Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Dateien zu manipulieren, um einen Denial-of-Service-Zustand erzuegen, um vertrauliche Informationen offenzulegen, um die Sicherheitsmaßnahmen zu umgehen und beliebigen Code auszuführen.
Betroffene Betriebssysteme
- Linux
{ document: { aggregate_severity: { text: "hoch", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "IBM QRadar Security Information and Event Management (SIEM) bietet Unterstützung bei der Erkennung und Priorisierung von Sicherheitsbedrohungen im Unternehmen.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Dateien zu manipulieren, um einen Denial-of-Service-Zustand erzuegen, um vertrauliche Informationen offenzulegen, um die Sicherheitsmaßnahmen zu umgehen und beliebigen Code auszuführen.", title: "Angriff", }, { category: "general", text: "- Linux", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2024-1313 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1313.json", }, { category: "self", summary: "WID-SEC-2024-1313 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1313", }, { category: "external", summary: "IBM Security Bulletin vom 2024-06-06", url: "https://www.ibm.com/support/pages/node/7156667", }, ], source_lang: "en-US", title: "IBM QRadar SIEM: Mehrere Schwachstellen", tracking: { current_release_date: "2024-12-01T23:00:00.000+00:00", generator: { date: "2024-12-02T11:03:55.226+00:00", engine: { name: "BSI-WID", version: "1.3.8", }, }, id: "WID-SEC-W-2024-1313", initial_release_date: "2024-06-06T22:00:00.000+00:00", revision_history: [ { date: "2024-06-06T22:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, { date: "2024-12-01T23:00:00.000+00:00", number: "2", summary: "Korrektur Plattformauswahl", }, ], status: "final", version: "2", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version_range", name: "<7.5.0 UP8 IF03", product: { name: "IBM QRadar SIEM <7.5.0 UP8 IF03", product_id: "T035249", }, }, { category: "product_version", name: "7.5.0 UP8 IF03", product: { name: "IBM QRadar SIEM 7.5.0 UP8 IF03", product_id: "T035249-fixed", product_identification_helper: { cpe: "cpe:/a:ibm:qradar_siem:7.5.0_up8_if03", }, }, }, ], category: "product_name", name: "QRadar SIEM", }, ], category: "vendor", name: "IBM", }, ], }, vulnerabilities: [ { cve: "CVE-2024-22243", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen. Diese Fehler betreffen das VMware Tanzu Spring Framework aufgrund eines offenen Redirects in UriComponentsBuilder. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Phising-Angriff durchzuführen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2024-22243", }, { cve: "CVE-2024-22259", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen. Diese Fehler betreffen das VMware Tanzu Spring Framework aufgrund eines offenen Redirects in UriComponentsBuilder. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Phising-Angriff durchzuführen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2024-22259", }, { cve: "CVE-2024-22262", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen. Diese Fehler betreffen das VMware Tanzu Spring Framework aufgrund eines offenen Redirects in UriComponentsBuilder. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Phising-Angriff durchzuführen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2024-22262", }, { cve: "CVE-2023-40546", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in den Komponenten ISC BIND und rhboot shim. Diese bestehen aufgrund unsachgemäßem Parsing, Fehlern bei der Antwortverarbeitung, einer NULL-Zeiger-Dereferenz und einem Out-of-Bounds-Read-Fehler. Ein entfernter, anonymer oder ein lokaler, privilegierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-40546", }, { cve: "CVE-2023-40549", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in den Komponenten ISC BIND und rhboot shim. Diese bestehen aufgrund unsachgemäßem Parsing, Fehlern bei der Antwortverarbeitung, einer NULL-Zeiger-Dereferenz und einem Out-of-Bounds-Read-Fehler. Ein entfernter, anonymer oder ein lokaler, privilegierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-40549", }, { cve: "CVE-2023-40551", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in den Komponenten ISC BIND und rhboot shim. Diese bestehen aufgrund unsachgemäßem Parsing, Fehlern bei der Antwortverarbeitung, einer NULL-Zeiger-Dereferenz und einem Out-of-Bounds-Read-Fehler. Ein entfernter, anonymer oder ein lokaler, privilegierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-40551", }, { cve: "CVE-2023-4408", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in den Komponenten ISC BIND und rhboot shim. Diese bestehen aufgrund unsachgemäßem Parsing, Fehlern bei der Antwortverarbeitung, einer NULL-Zeiger-Dereferenz und einem Out-of-Bounds-Read-Fehler. Ein entfernter, anonymer oder ein lokaler, privilegierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-4408", }, { cve: "CVE-2023-50387", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in den Komponenten ISC BIND und rhboot shim. Diese bestehen aufgrund unsachgemäßem Parsing, Fehlern bei der Antwortverarbeitung, einer NULL-Zeiger-Dereferenz und einem Out-of-Bounds-Read-Fehler. Ein entfernter, anonymer oder ein lokaler, privilegierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-50387", }, { cve: "CVE-2023-50868", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in den Komponenten ISC BIND und rhboot shim. Diese bestehen aufgrund unsachgemäßem Parsing, Fehlern bei der Antwortverarbeitung, einer NULL-Zeiger-Dereferenz und einem Out-of-Bounds-Read-Fehler. Ein entfernter, anonymer oder ein lokaler, privilegierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-50868", }, { cve: "CVE-2023-40547", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen. Diese Fehler bestehen in rhboot-Shim aufgrund eines Out-of-Bounds-Write und eines Heap-basierten Pufferüberlaufs. Ein Angreifer aus einem angrenzenden Netzwerk oder ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-40547", }, { cve: "CVE-2023-40548", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen. Diese Fehler bestehen in rhboot-Shim aufgrund eines Out-of-Bounds-Write und eines Heap-basierten Pufferüberlaufs. Ein Angreifer aus einem angrenzenden Netzwerk oder ein lokaler Angreifer kann diese Schwachstellen zur Ausführung von beliebigem Code ausnutzen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-40548", }, { cve: "CVE-2023-40550", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen. Diese Fehler besteht in rhboot-Shim aufgrund eines Out-of-Bound-Lesefehlers in der Funktion verify_buffer_sbat(). Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-40550", }, { cve: "CVE-2023-3758", notes: [ { category: "description", text: "In IBM QRadar SIEM existieren mehrere Schwachstellen in der SSSD-Komponente. Die GPO-Richtlinie für authentifizierte Benutzer wird nicht konsistent angewendet. Ein Angreifer aus einem angrenzenden Netzwerk kann diese Schwachstelle ausnutzen, um Sicherheitsmaßnahmen bzgl. Autorisierung zu umgehen.", }, ], product_status: { known_affected: [ "T035249", ], }, release_date: "2024-06-06T22:00:00.000+00:00", title: "CVE-2023-3758", }, ], }
wid-sec-w-2024-2100
Vulnerability from csaf_certbund
Published
2024-09-10 22:00
Modified
2024-09-10 22:00
Summary
IBM Power Hardware Management Console: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Die Hardware Management Console (HMC) von IBM ist ein System zur Virtualisierung von IBM Servern.
Angriff
Ein Angreifer kann mehrere Schwachstellen in IBM Power Hardware Management Console ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen preiszugeben.
Betroffene Betriebssysteme
- Sonstiges
- UNIX
{ document: { aggregate_severity: { text: "hoch", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Die Hardware Management Console (HMC) von IBM ist ein System zur Virtualisierung von IBM Servern.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein Angreifer kann mehrere Schwachstellen in IBM Power Hardware Management Console ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen preiszugeben.", title: "Angriff", }, { category: "general", text: "- Sonstiges\n- UNIX", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2024-2100 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-2100.json", }, { category: "self", summary: "WID-SEC-2024-2100 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-2100", }, { category: "external", summary: "IBM Security Bulletin 7168007 vom 2024-09-10", url: "https://www.ibm.com/support/pages/node/7168007", }, { category: "external", summary: "IBM Security Bulletin 7168008 vom 2024-09-10", url: "https://www.ibm.com/support/pages/node/7168008", }, { category: "external", summary: "IBM Security Bulletin 7168013 vom 2024-09-10", url: "https://www.ibm.com/support/pages/node/7168013", }, { category: "external", summary: "IBM Security Bulletin 7168015 vom 2024-09-10", url: "https://www.ibm.com/support/pages/node/7168015", }, { category: "external", summary: "IBM Security Bulletin 7168014 vom 2024-09-10", url: "https://www.ibm.com/support/pages/node/7168014", }, { category: "external", summary: "IBM Security Bulletin 7168016 vom 2024-09-10", url: "https://www.ibm.com/support/pages/node/7168016", }, { category: "external", summary: "IBM Security Bulletin 7168017 vom 2024-09-10", url: "https://www.ibm.com/support/pages/node/7168017", }, { category: "external", summary: "IBM Security Bulletin 7168018 vom 2024-09-10", url: "https://www.ibm.com/support/pages/node/7168018", }, { category: "external", summary: "IBM Security Bulletin 7168019 vom 2024-09-10", url: "https://www.ibm.com/support/pages/node/7168019", }, { category: "external", summary: "IBM Security Bulletin 7168020 vom 2024-09-10", url: "https://www.ibm.com/support/pages/node/7168020", }, ], source_lang: "en-US", title: "IBM Power Hardware Management Console: Mehrere Schwachstellen", tracking: { current_release_date: "2024-09-10T22:00:00.000+00:00", generator: { date: "2024-09-11T08:15:41.154+00:00", engine: { name: "BSI-WID", version: "1.3.6", }, }, id: "WID-SEC-W-2024-2100", initial_release_date: "2024-09-10T22:00:00.000+00:00", revision_history: [ { date: "2024-09-10T22:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version_range", name: "<V10.2.1040.0 SP2 x86", product: { name: "IBM Power Hardware Management Console <V10.2.1040.0 SP2 x86", product_id: "T037441", }, }, { category: "product_version", name: "V10.2.1040.0 SP2 x86", product: { name: "IBM Power Hardware Management Console V10.2.1040.0 SP2 x86", product_id: "T037441-fixed", product_identification_helper: { cpe: "cpe:/a:ibm:hardware_management_console:v10.2.1040.0_sp2_x86", }, }, }, { category: "product_version_range", name: "<V10.2.1040.0 SP2 ppc", product: { name: "IBM Power Hardware Management Console <V10.2.1040.0 SP2 ppc", product_id: "T037443", }, }, { category: "product_version", name: "V10.2.1040.0 SP2 ppc", product: { name: "IBM Power Hardware Management Console V10.2.1040.0 SP2 ppc", product_id: "T037443-fixed", product_identification_helper: { cpe: "cpe:/a:ibm:hardware_management_console:v10.2.1040.0_sp2_ppc", }, }, }, { category: "product_version_range", name: "<V10.3.1060.0 x86", product: { name: "IBM Power Hardware Management Console <V10.3.1060.0 x86", product_id: "T037444", }, }, { category: "product_version", name: "V10.3.1060.0 x86", product: { name: "IBM Power Hardware Management Console V10.3.1060.0 x86", product_id: "T037444-fixed", product_identification_helper: { cpe: "cpe:/a:ibm:hardware_management_console:v10.3.1060.0_x86", }, }, }, { category: "product_version_range", name: "<V10.3.1060.0 ppc", product: { name: "IBM Power Hardware Management Console <V10.3.1060.0 ppc", product_id: "T037445", }, }, { category: "product_version", name: "V10.3.1060.0 ppc", product: { name: "IBM Power Hardware Management Console V10.3.1060.0 ppc", product_id: "T037445-fixed", product_identification_helper: { cpe: "cpe:/a:ibm:hardware_management_console:v10.3.1060.0_ppc", }, }, }, ], category: "product_name", name: "Power Hardware Management Console", }, ], category: "vendor", name: "IBM", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", notes: [ { category: "description", text: "In IBM Power Hardware Management Console existieren mehrere Schwachstellen. Diese Schwachstellen betreffen die rhboot-Shim-Komponente und werden durch Fehler wie NULL-Zeiger-Dereferenzierung, Out-of-Bounds-Schreib- und Lesevorgänge und Integer-Überläufe verursacht. Ein lokaler Angreifer oder ein Angreifer aus einem benachbarten Netzwerk kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen preiszugeben.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-40546", }, { cve: "CVE-2023-40547", notes: [ { category: "description", text: "In IBM Power Hardware Management Console existieren mehrere Schwachstellen. Diese Schwachstellen betreffen die rhboot-Shim-Komponente und werden durch Fehler wie NULL-Zeiger-Dereferenzierung, Out-of-Bounds-Schreib- und Lesevorgänge und Integer-Überläufe verursacht. Ein lokaler Angreifer oder ein Angreifer aus einem benachbarten Netzwerk kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen preiszugeben.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-40547", }, { cve: "CVE-2023-40548", notes: [ { category: "description", text: "In IBM Power Hardware Management Console existieren mehrere Schwachstellen. Diese Schwachstellen betreffen die rhboot-Shim-Komponente und werden durch Fehler wie NULL-Zeiger-Dereferenzierung, Out-of-Bounds-Schreib- und Lesevorgänge und Integer-Überläufe verursacht. Ein lokaler Angreifer oder ein Angreifer aus einem benachbarten Netzwerk kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen preiszugeben.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-40548", }, { cve: "CVE-2023-40549", notes: [ { category: "description", text: "In IBM Power Hardware Management Console existieren mehrere Schwachstellen. Diese Schwachstellen betreffen die rhboot-Shim-Komponente und werden durch Fehler wie NULL-Zeiger-Dereferenzierung, Out-of-Bounds-Schreib- und Lesevorgänge und Integer-Überläufe verursacht. Ein lokaler Angreifer oder ein Angreifer aus einem benachbarten Netzwerk kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen preiszugeben.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-40549", }, { cve: "CVE-2023-40550", notes: [ { category: "description", text: "In IBM Power Hardware Management Console existieren mehrere Schwachstellen. Diese Schwachstellen betreffen die rhboot-Shim-Komponente und werden durch Fehler wie NULL-Zeiger-Dereferenzierung, Out-of-Bounds-Schreib- und Lesevorgänge und Integer-Überläufe verursacht. Ein lokaler Angreifer oder ein Angreifer aus einem benachbarten Netzwerk kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen preiszugeben.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-40550", }, { cve: "CVE-2023-40551", notes: [ { category: "description", text: "In IBM Power Hardware Management Console existieren mehrere Schwachstellen. Diese Schwachstellen betreffen die rhboot-Shim-Komponente und werden durch Fehler wie NULL-Zeiger-Dereferenzierung, Out-of-Bounds-Schreib- und Lesevorgänge und Integer-Überläufe verursacht. Ein lokaler Angreifer oder ein Angreifer aus einem benachbarten Netzwerk kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen preiszugeben.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-40551", }, { cve: "CVE-2023-6135", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in der IBM Power Hardware Management Console. Dieser Fehler betrifft die Mozilla Network Security Services NIST-Kurve, die in Mozilla Firefox verwendet wird, und zwar durch einen als Minerva bekannten Side-Channel-Angriff, der die Wiederherstellung des privaten Schlüssels ermöglicht. Ein anonymer Angreifer kann diese Schwachstelle ausnutzen, indem er ein Opfer dazu bringt, eine speziell gestaltete Website zu besuchen, um vertrauliche Informationen preiszugeben. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-6135", }, { cve: "CVE-2023-39615", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in IBM Power Hardware Management Console. Dieser Fehler besteht in Xmlsoft Libxml2 aufgrund eines Pufferüberlaufs. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, indem er eine manipulierte XML-Datei bereitstellt.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-39615", }, { cve: "CVE-2023-5388", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in IBM Power Hardware Management Console. Dieser Fehler ist auf eine beobachtbare Zeitdiskrepanz in der numerischen Bibliothek zurückzuführen, die in NSS für die RSA-Kryptographie verwendet wird. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen preiszugeben und diese Informationen für weitere Angriffe zu verwenden.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-5388", }, { cve: "CVE-2023-3446", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in IBM Power Hardware Management Console. Diese Fehler betreffen die OpenSSL-Bibliothek aufgrund einer unsachgemäßen Behandlung von DH-Schlüsseln und Parametern während der Schlüsselvalidierung und -erzeugung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-3446", }, { cve: "CVE-2023-3817", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in IBM Power Hardware Management Console. Diese Fehler betreffen die OpenSSL-Bibliothek aufgrund einer unsachgemäßen Behandlung von DH-Schlüsseln und Parametern während der Schlüsselvalidierung und -erzeugung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-3817", }, { cve: "CVE-2023-5678", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in IBM Power Hardware Management Console. Diese Fehler betreffen die OpenSSL-Bibliothek aufgrund einer unsachgemäßen Behandlung von DH-Schlüsseln und Parametern während der Schlüsselvalidierung und -erzeugung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-5678", }, { cve: "CVE-2024-34750", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in IBM Power Hardware Management Console. Diese Fehler betrifft den Apache Tomcat Server aufgrund eines Fehlers bei der Verarbeitung eines HTTP/2-Streams. Durch das Senden speziell gestalteter HTTP-Header kann ein entfernter, anonymer Angreifer diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2024-34750", }, { cve: "CVE-2022-3094", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in IBM Power Hardware Management Console. Dieser Fehler betrifft ISC BIND aufgrund einer unsachgemäßen Speicherzuweisung, die es ermöglicht, UPDATE-Nachrichten zu senden, was zu einer Speichererschöpfung führt. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2022-3094", }, { cve: "CVE-2023-4641", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in IBM Power Hardware Management Console. Die shadow-utils Bibliothek ist von diesem Fehler betroffen, da Passwortinformationen unsachgemäß gehandhabt werden, insbesondere weil der Puffer zum Speichern von Passwörtern nicht gelöscht wird. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen preiszugeben.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-4641", }, { cve: "CVE-2023-22745", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in IBM Power Hardware Management Console. Dieser Fehler betrifft die tpm2-tss Bibliothek aufgrund einer unsachgemäßen Überprüfung der Grenzen in den Tss2_RC_SetHandler und Tss2_RC_Decode Funktionen, was zu einem Pufferüberlauf führt. Ein lokaler Angreifer mit hohen Privilegien kann diese Schwachstelle zur Ausführung von beliebigem Code ausnutzen.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-22745", }, { cve: "CVE-2023-52425", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in IBM Power Hardware Management Console. Dieser Fehler betrifft die expat-Bibliothek aufgrund einer unsachgemäßen Zuweisung von Systemressourcen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, indem er eine speziell gestaltete Anfrage mit einem übermäßig großen Token sendet.", }, ], product_status: { known_affected: [ "T037444", "T037445", "T037441", "T037443", ], }, release_date: "2024-09-10T22:00:00.000+00:00", title: "CVE-2023-52425", }, ], }
wid-sec-w-2024-0903
Vulnerability from csaf_certbund
Published
2024-04-16 22:00
Modified
2024-10-09 22:00
Summary
Red Hat Enterprise Linux (shim): Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.
Angriff
Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in "shim" ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder beliebigen Code auszuführen.
Betroffene Betriebssysteme
- Linux
{ document: { aggregate_severity: { text: "hoch", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in \"shim\" ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder beliebigen Code auszuführen.", title: "Angriff", }, { category: "general", text: "- Linux", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2024-0903 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0903.json", }, { category: "self", summary: "WID-SEC-2024-0903 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0903", }, { category: "external", summary: "Red Hat Security Advisory vom 2024-04-16", url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "external", summary: "Red Hat Security Advisory vom 2024-04-16", url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1873 vom 2024-04-18", url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1883 vom 2024-04-18", url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1876 vom 2024-04-18", url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1903 vom 2024-04-18", url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1902 vom 2024-04-18", url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2024:1368-1 vom 2024-04-22", url: "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018392.html", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1959 vom 2024-04-23", url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "external", summary: "Oracle Linux Security Advisory ELSA-2024-1903 vom 2024-04-24", url: "http://linux.oracle.com/errata/ELSA-2024-1903.html", }, { category: "external", summary: "Oracle Linux Security Advisory ELSA-2024-1902 vom 2024-04-26", url: "https://linux.oracle.com/errata/ELSA-2024-1902.html", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:2086 vom 2024-04-29", url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "external", summary: "Oracle Linux Security Advisory ELSA-2024-1959 vom 2024-05-03", url: "https://linux.oracle.com/errata/ELSA-2024-1959.html", }, { category: "external", summary: "Debian Security Advisory DLA-3813 vom 2024-05-14", url: "https://lists.debian.org/debian-lts-announce/2024/05/msg00009.html", }, { category: "external", summary: "Dell Security Advisory DSA-2024-422 vom 2024-10-10", url: "https://www.dell.com/support/kbdoc/de-de/000234730/dsa-2024-422-security-update-for-dell-networker-vproxy-multiple-component-vulnerabilities", }, ], source_lang: "en-US", title: "Red Hat Enterprise Linux (shim): Mehrere Schwachstellen", tracking: { current_release_date: "2024-10-09T22:00:00.000+00:00", generator: { date: "2024-10-10T11:52:35.794+00:00", engine: { name: "BSI-WID", version: "1.3.8", }, }, id: "WID-SEC-W-2024-0903", initial_release_date: "2024-04-16T22:00:00.000+00:00", revision_history: [ { date: "2024-04-16T22:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, { date: "2024-04-17T22:00:00.000+00:00", number: "2", summary: "Neue Updates von Red Hat aufgenommen", }, { date: "2024-04-22T22:00:00.000+00:00", number: "3", summary: "Neue Updates von SUSE und Red Hat aufgenommen", }, { date: "2024-04-24T22:00:00.000+00:00", number: "4", summary: "Neue Updates von Oracle Linux aufgenommen", }, { date: "2024-04-25T22:00:00.000+00:00", number: "5", summary: "Neue Updates von Oracle Linux aufgenommen", }, { date: "2024-04-28T22:00:00.000+00:00", number: "6", summary: "Neue Updates von Red Hat aufgenommen", }, { date: "2024-05-02T22:00:00.000+00:00", number: "7", summary: "Neue Updates von Oracle Linux aufgenommen", }, { date: "2024-05-14T22:00:00.000+00:00", number: "8", summary: "Neue Updates von Debian aufgenommen", }, { date: "2024-10-09T22:00:00.000+00:00", number: "9", summary: "Neue Updates von Dell aufgenommen", }, ], status: "final", version: "9", }, }, product_tree: { branches: [ { branches: [ { category: "product_name", name: "Debian Linux", product: { name: "Debian Linux", product_id: "2951", product_identification_helper: { cpe: "cpe:/o:debian:debian_linux:-", }, }, }, ], category: "vendor", name: "Debian", }, { branches: [ { category: "product_name", name: "Oracle Linux", product: { name: "Oracle Linux", product_id: "T004914", product_identification_helper: { cpe: "cpe:/o:oracle:linux:-", }, }, }, ], category: "vendor", name: "Oracle", }, { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux", product: { name: "Red Hat Enterprise Linux", product_id: "67646", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:-", }, }, }, { category: "product_version", name: "8.2", product: { name: "Red Hat Enterprise Linux 8.2", product_id: "T034282", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:8.2", }, }, }, { category: "product_version", name: "9", product: { name: "Red Hat Enterprise Linux 9", product_id: "T034283", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:9", }, }, }, ], category: "product_name", name: "Enterprise Linux", }, ], category: "vendor", name: "Red Hat", }, { branches: [ { category: "product_name", name: "SUSE Linux", product: { name: "SUSE Linux", product_id: "T002207", product_identification_helper: { cpe: "cpe:/o:suse:suse_linux:-", }, }, }, ], category: "vendor", name: "SUSE", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Dieser Fehler besteht in der Shim-Komponente aufgrund eines Heap-basierten Pufferüberlaufs und eines Out-of-bounds-Read-Problems. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen.", }, ], product_status: { known_affected: [ "2951", "T002207", "T034282", "67646", "T034283", "T004914", ], }, release_date: "2024-04-16T22:00:00.000+00:00", title: "CVE-2023-40546", }, { cve: "CVE-2023-40548", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Dieser Fehler besteht in der Shim-Komponente aufgrund eines Heap-basierten Pufferüberlaufs und eines Out-of-bounds-Read-Problems. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen.", }, ], product_status: { known_affected: [ "2951", "T002207", "T034282", "67646", "T034283", "T004914", ], }, release_date: "2024-04-16T22:00:00.000+00:00", title: "CVE-2023-40548", }, { cve: "CVE-2023-40549", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Dieser Fehler besteht in der Shim-Komponente aufgrund eines Heap-basierten Pufferüberlaufs und eines Out-of-bounds-Read-Problems. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen.", }, ], product_status: { known_affected: [ "2951", "T002207", "T034282", "67646", "T034283", "T004914", ], }, release_date: "2024-04-16T22:00:00.000+00:00", title: "CVE-2023-40549", }, { cve: "CVE-2023-40547", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in Red Hat Enterprise Linux. Dieser Fehler besteht in der Shim-Komponente aufgrund eines Out-of-bounds-Write-Problems, das eine vollständige Kompromittierung des Systems ermöglicht. Ein benachbarter, anonymer Angreifer kann diese Schwachstelle zur Ausführung von beliebigem Code ausnutzen.", }, ], product_status: { known_affected: [ "2951", "T002207", "T034282", "67646", "T034283", "T004914", ], }, release_date: "2024-04-16T22:00:00.000+00:00", title: "CVE-2023-40547", }, { cve: "CVE-2023-40550", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in Red Hat Enterprise Linux. Dieser Fehler besteht in der Shim-Komponente während der Validierung der SBAT-Informationen, was dazu führt, dass sensible Daten während der Boot-Phase des Systems offengelegt werden. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "2951", "T002207", "T034282", "67646", "T034283", "T004914", ], }, release_date: "2024-04-16T22:00:00.000+00:00", title: "CVE-2023-40550", }, { cve: "CVE-2023-40551", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in Red Hat Enterprise Linux. Dieser Fehler besteht im MZ-Binärformat in der Shim-Komponente aufgrund eines Out-of-bounds-Read-Problems. Ein lokaler, privilegierter Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu verursachen.", }, ], product_status: { known_affected: [ "2951", "T002207", "T034282", "67646", "T034283", "T004914", ], }, release_date: "2024-04-16T22:00:00.000+00:00", title: "CVE-2023-40551", }, ], }
WID-SEC-W-2024-0903
Vulnerability from csaf_certbund
Published
2024-04-16 22:00
Modified
2024-10-09 22:00
Summary
Red Hat Enterprise Linux (shim): Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.
Angriff
Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in "shim" ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder beliebigen Code auszuführen.
Betroffene Betriebssysteme
- Linux
{ document: { aggregate_severity: { text: "hoch", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in \"shim\" ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder beliebigen Code auszuführen.", title: "Angriff", }, { category: "general", text: "- Linux", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2024-0903 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0903.json", }, { category: "self", summary: "WID-SEC-2024-0903 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0903", }, { category: "external", summary: "Red Hat Security Advisory vom 2024-04-16", url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { category: "external", summary: "Red Hat Security Advisory vom 2024-04-16", url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1873 vom 2024-04-18", url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1883 vom 2024-04-18", url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1876 vom 2024-04-18", url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1903 vom 2024-04-18", url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1902 vom 2024-04-18", url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2024:1368-1 vom 2024-04-22", url: "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018392.html", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1959 vom 2024-04-23", url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { category: "external", summary: "Oracle Linux Security Advisory ELSA-2024-1903 vom 2024-04-24", url: "http://linux.oracle.com/errata/ELSA-2024-1903.html", }, { category: "external", summary: "Oracle Linux Security Advisory ELSA-2024-1902 vom 2024-04-26", url: "https://linux.oracle.com/errata/ELSA-2024-1902.html", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:2086 vom 2024-04-29", url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { category: "external", summary: "Oracle Linux Security Advisory ELSA-2024-1959 vom 2024-05-03", url: "https://linux.oracle.com/errata/ELSA-2024-1959.html", }, { category: "external", summary: "Debian Security Advisory DLA-3813 vom 2024-05-14", url: "https://lists.debian.org/debian-lts-announce/2024/05/msg00009.html", }, { category: "external", summary: "Dell Security Advisory DSA-2024-422 vom 2024-10-10", url: "https://www.dell.com/support/kbdoc/de-de/000234730/dsa-2024-422-security-update-for-dell-networker-vproxy-multiple-component-vulnerabilities", }, ], source_lang: "en-US", title: "Red Hat Enterprise Linux (shim): Mehrere Schwachstellen", tracking: { current_release_date: "2024-10-09T22:00:00.000+00:00", generator: { date: "2024-10-10T11:52:35.794+00:00", engine: { name: "BSI-WID", version: "1.3.8", }, }, id: "WID-SEC-W-2024-0903", initial_release_date: "2024-04-16T22:00:00.000+00:00", revision_history: [ { date: "2024-04-16T22:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, { date: "2024-04-17T22:00:00.000+00:00", number: "2", summary: "Neue Updates von Red Hat aufgenommen", }, { date: "2024-04-22T22:00:00.000+00:00", number: "3", summary: "Neue Updates von SUSE und Red Hat aufgenommen", }, { date: "2024-04-24T22:00:00.000+00:00", number: "4", summary: "Neue Updates von Oracle Linux aufgenommen", }, { date: "2024-04-25T22:00:00.000+00:00", number: "5", summary: "Neue Updates von Oracle Linux aufgenommen", }, { date: "2024-04-28T22:00:00.000+00:00", number: "6", summary: "Neue Updates von Red Hat aufgenommen", }, { date: "2024-05-02T22:00:00.000+00:00", number: "7", summary: "Neue Updates von Oracle Linux aufgenommen", }, { date: "2024-05-14T22:00:00.000+00:00", number: "8", summary: "Neue Updates von Debian aufgenommen", }, { date: "2024-10-09T22:00:00.000+00:00", number: "9", summary: "Neue Updates von Dell aufgenommen", }, ], status: "final", version: "9", }, }, product_tree: { branches: [ { branches: [ { category: "product_name", name: "Debian Linux", product: { name: "Debian Linux", product_id: "2951", product_identification_helper: { cpe: "cpe:/o:debian:debian_linux:-", }, }, }, ], category: "vendor", name: "Debian", }, { branches: [ { category: "product_name", name: "Oracle Linux", product: { name: "Oracle Linux", product_id: "T004914", product_identification_helper: { cpe: "cpe:/o:oracle:linux:-", }, }, }, ], category: "vendor", name: "Oracle", }, { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux", product: { name: "Red Hat Enterprise Linux", product_id: "67646", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:-", }, }, }, { category: "product_version", name: "8.2", product: { name: "Red Hat Enterprise Linux 8.2", product_id: "T034282", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:8.2", }, }, }, { category: "product_version", name: "9", product: { name: "Red Hat Enterprise Linux 9", product_id: "T034283", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:9", }, }, }, ], category: "product_name", name: "Enterprise Linux", }, ], category: "vendor", name: "Red Hat", }, { branches: [ { category: "product_name", name: "SUSE Linux", product: { name: "SUSE Linux", product_id: "T002207", product_identification_helper: { cpe: "cpe:/o:suse:suse_linux:-", }, }, }, ], category: "vendor", name: "SUSE", }, ], }, vulnerabilities: [ { cve: "CVE-2023-40546", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Dieser Fehler besteht in der Shim-Komponente aufgrund eines Heap-basierten Pufferüberlaufs und eines Out-of-bounds-Read-Problems. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen.", }, ], product_status: { known_affected: [ "2951", "T002207", "T034282", "67646", "T034283", "T004914", ], }, release_date: "2024-04-16T22:00:00.000+00:00", title: "CVE-2023-40546", }, { cve: "CVE-2023-40548", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Dieser Fehler besteht in der Shim-Komponente aufgrund eines Heap-basierten Pufferüberlaufs und eines Out-of-bounds-Read-Problems. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen.", }, ], product_status: { known_affected: [ "2951", "T002207", "T034282", "67646", "T034283", "T004914", ], }, release_date: "2024-04-16T22:00:00.000+00:00", title: "CVE-2023-40548", }, { cve: "CVE-2023-40549", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Dieser Fehler besteht in der Shim-Komponente aufgrund eines Heap-basierten Pufferüberlaufs und eines Out-of-bounds-Read-Problems. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen.", }, ], product_status: { known_affected: [ "2951", "T002207", "T034282", "67646", "T034283", "T004914", ], }, release_date: "2024-04-16T22:00:00.000+00:00", title: "CVE-2023-40549", }, { cve: "CVE-2023-40547", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in Red Hat Enterprise Linux. Dieser Fehler besteht in der Shim-Komponente aufgrund eines Out-of-bounds-Write-Problems, das eine vollständige Kompromittierung des Systems ermöglicht. Ein benachbarter, anonymer Angreifer kann diese Schwachstelle zur Ausführung von beliebigem Code ausnutzen.", }, ], product_status: { known_affected: [ "2951", "T002207", "T034282", "67646", "T034283", "T004914", ], }, release_date: "2024-04-16T22:00:00.000+00:00", title: "CVE-2023-40547", }, { cve: "CVE-2023-40550", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in Red Hat Enterprise Linux. Dieser Fehler besteht in der Shim-Komponente während der Validierung der SBAT-Informationen, was dazu führt, dass sensible Daten während der Boot-Phase des Systems offengelegt werden. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen.", }, ], product_status: { known_affected: [ "2951", "T002207", "T034282", "67646", "T034283", "T004914", ], }, release_date: "2024-04-16T22:00:00.000+00:00", title: "CVE-2023-40550", }, { cve: "CVE-2023-40551", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in Red Hat Enterprise Linux. Dieser Fehler besteht im MZ-Binärformat in der Shim-Komponente aufgrund eines Out-of-bounds-Read-Problems. Ein lokaler, privilegierter Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu verursachen.", }, ], product_status: { known_affected: [ "2951", "T002207", "T034282", "67646", "T034283", "T004914", ], }, release_date: "2024-04-16T22:00:00.000+00:00", title: "CVE-2023-40551", }, ], }
suse-su-2024:1368-1
Vulnerability from csaf_suse
Published
2024-04-22 09:06
Modified
2024-04-22 09:06
Summary
Security update for shim
Notes
Title of the patch
Security update for shim
Description of the patch
This update for shim fixes the following issues:
- Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)
- Limit the requirement of fde-tpm-helper-macros to the distro with
suse_version 1600 and above (bsc#1219460)
Update to version 15.8:
Security issues fixed:
- mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)
- avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)
- Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)
- Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)
- pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)
- pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)
The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now.
- Generate dbx during build so we don't include binary files in sources
- Don't require grub so shim can still be used with systemd-boot
- Update shim-install to fix boot failure of ext4 root file system
on RAID10 (bsc#1205855)
- Adopt the macros from fde-tpm-helper-macros to update the
signature in the sealed key after a bootloader upgrade
- Update shim-install to amend full disk encryption support
- Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector
- Use the long name to specify the grub2 key protector
- cryptodisk: support TPM authorized policies
- Do not use tpm_record_pcrs unless the command is in command.lst
- Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to
enable the NX compatibility flag when using post-process-pe after
discussed with grub2 experts in mail. It's useful for further development
and testing. (bsc#1205588)
Patchnames
SUSE-2024-1368,SUSE-SLE-Micro-5.3-2024-1368,SUSE-SLE-Micro-5.4-2024-1368,SUSE-SLE-Micro-5.5-2024-1368,SUSE-SLE-Module-Basesystem-15-SP5-2024-1368,SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-1368,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-1368,SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-1368,SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-1368,SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-1368,SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-1368,SUSE-SLE-Product-SLES_SAP-15-SP3-2024-1368,SUSE-SLE-Product-SLES_SAP-15-SP4-2024-1368,SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-1368,SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-1368,SUSE-SUSE-MicroOS-5.1-2024-1368,SUSE-SUSE-MicroOS-5.2-2024-1368,SUSE-Storage-7.1-2024-1368,openSUSE-Leap-Micro-5.3-2024-1368,openSUSE-Leap-Micro-5.4-2024-1368,openSUSE-SLE-15.5-2024-1368
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for shim", title: "Title of the patch", }, { category: "description", text: "This update for shim fixes the following issues:\n\n- Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)\n- Limit the requirement of fde-tpm-helper-macros to the distro with\n suse_version 1600 and above (bsc#1219460)\n\nUpdate to version 15.8:\n\nSecurity issues fixed:\n\n- mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)\n- avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)\n- Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)\n- Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)\n- pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)\n- pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)\n\n \nThe NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now.\n\n- Generate dbx during build so we don't include binary files in sources\n- Don't require grub so shim can still be used with systemd-boot\n- Update shim-install to fix boot failure of ext4 root file system\n on RAID10 (bsc#1205855)\n- Adopt the macros from fde-tpm-helper-macros to update the\n signature in the sealed key after a bootloader upgrade\n\n- Update shim-install to amend full disk encryption support\n - Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector\n - Use the long name to specify the grub2 key protector\n - cryptodisk: support TPM authorized policies\n - Do not use tpm_record_pcrs unless the command is in command.lst\n\n- Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to\n enable the NX compatibility flag when using post-process-pe after\n discussed with grub2 experts in mail. It's useful for further development\n and testing. (bsc#1205588)\n", title: "Description of the patch", }, { category: "details", text: "SUSE-2024-1368,SUSE-SLE-Micro-5.3-2024-1368,SUSE-SLE-Micro-5.4-2024-1368,SUSE-SLE-Micro-5.5-2024-1368,SUSE-SLE-Module-Basesystem-15-SP5-2024-1368,SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-1368,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-1368,SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-1368,SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-1368,SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-1368,SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-1368,SUSE-SLE-Product-SLES_SAP-15-SP3-2024-1368,SUSE-SLE-Product-SLES_SAP-15-SP4-2024-1368,SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-1368,SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-1368,SUSE-SUSE-MicroOS-5.1-2024-1368,SUSE-SUSE-MicroOS-5.2-2024-1368,SUSE-Storage-7.1-2024-1368,openSUSE-Leap-Micro-5.3-2024-1368,openSUSE-Leap-Micro-5.4-2024-1368,openSUSE-SLE-15.5-2024-1368", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_1368-1.json", }, { category: "self", summary: "URL for SUSE-SU-2024:1368-1", url: "https://www.suse.com/support/update/announcement/2024/suse-su-20241368-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2024:1368-1", url: "https://lists.suse.com/pipermail/sle-updates/2024-April/035046.html", }, { category: "self", summary: "SUSE Bug 1198101", url: "https://bugzilla.suse.com/1198101", }, { category: "self", summary: "SUSE Bug 1205588", url: "https://bugzilla.suse.com/1205588", }, { category: "self", summary: "SUSE Bug 1205855", url: "https://bugzilla.suse.com/1205855", }, { category: "self", summary: "SUSE Bug 1210382", url: "https://bugzilla.suse.com/1210382", }, { category: "self", summary: "SUSE Bug 1213945", url: "https://bugzilla.suse.com/1213945", }, { category: "self", summary: "SUSE Bug 1215098", url: "https://bugzilla.suse.com/1215098", }, { category: "self", summary: "SUSE Bug 1215099", url: "https://bugzilla.suse.com/1215099", }, { category: "self", summary: "SUSE Bug 1215100", url: "https://bugzilla.suse.com/1215100", }, { category: "self", summary: "SUSE Bug 1215101", url: "https://bugzilla.suse.com/1215101", }, { category: "self", summary: "SUSE Bug 1215102", url: "https://bugzilla.suse.com/1215102", }, { category: "self", summary: "SUSE Bug 1215103", url: "https://bugzilla.suse.com/1215103", }, { category: "self", summary: "SUSE Bug 1219460", url: "https://bugzilla.suse.com/1219460", }, { category: "self", summary: "SUSE CVE CVE-2022-28737 page", url: "https://www.suse.com/security/cve/CVE-2022-28737/", }, { category: "self", summary: "SUSE CVE CVE-2023-40546 page", url: "https://www.suse.com/security/cve/CVE-2023-40546/", }, { category: "self", summary: "SUSE CVE CVE-2023-40547 page", url: "https://www.suse.com/security/cve/CVE-2023-40547/", }, { category: "self", summary: "SUSE CVE CVE-2023-40548 page", url: "https://www.suse.com/security/cve/CVE-2023-40548/", }, { category: "self", summary: "SUSE CVE CVE-2023-40549 page", url: "https://www.suse.com/security/cve/CVE-2023-40549/", }, { category: "self", summary: "SUSE CVE CVE-2023-40550 page", url: "https://www.suse.com/security/cve/CVE-2023-40550/", }, { category: "self", summary: "SUSE CVE CVE-2023-40551 page", url: "https://www.suse.com/security/cve/CVE-2023-40551/", }, ], title: "Security update for shim", tracking: { current_release_date: "2024-04-22T09:06:33Z", generator: { date: "2024-04-22T09:06:33Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2024:1368-1", initial_release_date: "2024-04-22T09:06:33Z", revision_history: [ { date: "2024-04-22T09:06:33Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "efitools-1.9.2-150300.7.3.1.aarch64", product: { name: "efitools-1.9.2-150300.7.3.1.aarch64", product_id: "efitools-1.9.2-150300.7.3.1.aarch64", }, }, { category: "product_version", name: "shim-15.8-150300.4.20.2.aarch64", product: { name: "shim-15.8-150300.4.20.2.aarch64", product_id: "shim-15.8-150300.4.20.2.aarch64", }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "efitools-1.9.2-150300.7.3.1.i586", product: { name: "efitools-1.9.2-150300.7.3.1.i586", product_id: "efitools-1.9.2-150300.7.3.1.i586", }, }, ], category: "architecture", name: "i586", }, { branches: [ { category: "product_version", name: "efitools-1.9.2-150300.7.3.1.x86_64", product: { name: "efitools-1.9.2-150300.7.3.1.x86_64", product_id: "efitools-1.9.2-150300.7.3.1.x86_64", }, }, { category: "product_version", name: "shim-15.8-150300.4.20.2.x86_64", product: { name: "shim-15.8-150300.4.20.2.x86_64", product_id: "shim-15.8-150300.4.20.2.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "SUSE Linux Enterprise Micro 5.3", product: { name: "SUSE Linux Enterprise Micro 5.3", product_id: "SUSE Linux Enterprise Micro 5.3", product_identification_helper: { cpe: "cpe:/o:suse:sle-micro:5.3", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Micro 5.4", product: { name: "SUSE Linux Enterprise Micro 5.4", product_id: "SUSE Linux Enterprise Micro 5.4", product_identification_helper: { cpe: "cpe:/o:suse:sle-micro:5.4", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Micro 5.5", product: { name: "SUSE Linux Enterprise Micro 5.5", product_id: "SUSE Linux Enterprise Micro 5.5", product_identification_helper: { cpe: "cpe:/o:suse:sle-micro:5.5", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Module for Basesystem 15 SP5", product: { name: "SUSE Linux Enterprise Module for Basesystem 15 SP5", product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP5", product_identification_helper: { cpe: "cpe:/o:suse:sle-module-basesystem:15:sp5", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS", product: { name: "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS", product_id: "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS", product_identification_helper: { cpe: "cpe:/o:suse:sle_hpc-ltss:15:sp3", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS", product: { name: "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS", product_id: "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS", product_identification_helper: { cpe: "cpe:/o:suse:sle_hpc-espos:15:sp4", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS", product: { name: "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS", product_id: "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS", product_identification_helper: { cpe: "cpe:/o:suse:sle_hpc-ltss:15:sp4", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Server 15 SP3-LTSS", product: { name: "SUSE Linux Enterprise Server 15 SP3-LTSS", product_id: "SUSE Linux Enterprise Server 15 SP3-LTSS", product_identification_helper: { cpe: "cpe:/o:suse:sles-ltss:15:sp3", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Server 15 SP4-LTSS", product: { name: "SUSE Linux Enterprise Server 15 SP4-LTSS", product_id: "SUSE Linux Enterprise Server 15 SP4-LTSS", product_identification_helper: { cpe: "cpe:/o:suse:sles-ltss:15:sp4", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Server for SAP Applications 15 SP3", product: { name: "SUSE Linux Enterprise Server for SAP Applications 15 SP3", product_id: "SUSE Linux Enterprise Server for SAP Applications 15 SP3", product_identification_helper: { cpe: "cpe:/o:suse:sles_sap:15:sp3", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Server for SAP Applications 15 SP4", product: { name: "SUSE Linux Enterprise Server for SAP Applications 15 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 15 SP4", product_identification_helper: { cpe: "cpe:/o:suse:sles_sap:15:sp4", }, }, }, { category: "product_name", name: "SUSE Manager Proxy 4.3", product: { name: "SUSE Manager Proxy 4.3", product_id: "SUSE Manager Proxy 4.3", product_identification_helper: { cpe: "cpe:/o:suse:suse-manager-proxy:4.3", }, }, }, { category: "product_name", name: "SUSE Manager Server 4.3", product: { name: "SUSE Manager Server 4.3", product_id: "SUSE Manager Server 4.3", product_identification_helper: { cpe: "cpe:/o:suse:suse-manager-server:4.3", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Micro 5.1", product: { name: "SUSE Linux Enterprise Micro 5.1", product_id: "SUSE Linux Enterprise Micro 5.1", product_identification_helper: { cpe: "cpe:/o:suse:suse-microos:5.1", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Micro 5.2", product: { name: "SUSE Linux Enterprise Micro 5.2", product_id: "SUSE Linux Enterprise Micro 5.2", product_identification_helper: { cpe: "cpe:/o:suse:suse-microos:5.2", }, }, }, { category: "product_name", name: "SUSE Enterprise Storage 7.1", product: { name: "SUSE Enterprise Storage 7.1", product_id: "SUSE Enterprise Storage 7.1", product_identification_helper: { cpe: "cpe:/o:suse:ses:7.1", }, }, }, { category: "product_name", name: "openSUSE Leap Micro 5.3", product: { name: "openSUSE Leap Micro 5.3", product_id: "openSUSE Leap Micro 5.3", product_identification_helper: { cpe: "cpe:/o:opensuse:leap-micro:5.3", }, }, }, { category: "product_name", name: "openSUSE Leap Micro 5.4", product: { name: "openSUSE Leap Micro 5.4", product_id: "openSUSE Leap Micro 5.4", product_identification_helper: { cpe: "cpe:/o:opensuse:leap-micro:5.4", }, }, }, { category: "product_name", name: "openSUSE Leap 15.5", product: { name: "openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5", product_identification_helper: { cpe: "cpe:/o:opensuse:leap:15.5", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of SUSE Linux Enterprise Micro 5.3", product_id: "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Micro 5.3", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Linux Enterprise Micro 5.3", product_id: "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Micro 5.3", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of SUSE Linux Enterprise Micro 5.4", product_id: "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Micro 5.4", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Linux Enterprise Micro 5.4", product_id: "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Micro 5.4", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of SUSE Linux Enterprise Micro 5.5", product_id: "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Micro 5.5", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Linux Enterprise Micro 5.5", product_id: "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Micro 5.5", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP5", product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP5", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP5", product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP5", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS", product_id: "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS", product_id: "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS", product_id: "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS", product_id: "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS", product_id: "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS", product_id: "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS", product_id: "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Server 15 SP3-LTSS", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS", product_id: "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server 15 SP3-LTSS", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS", product_id: "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Server 15 SP4-LTSS", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS", product_id: "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server 15 SP4-LTSS", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3", product_id: "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 15 SP3", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 15 SP4", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Manager Proxy 4.3", product_id: "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Manager Proxy 4.3", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Manager Server 4.3", product_id: "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Manager Server 4.3", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of SUSE Linux Enterprise Micro 5.1", product_id: "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Micro 5.1", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Linux Enterprise Micro 5.1", product_id: "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Micro 5.1", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of SUSE Linux Enterprise Micro 5.2", product_id: "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Micro 5.2", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Linux Enterprise Micro 5.2", product_id: "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Micro 5.2", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of SUSE Enterprise Storage 7.1", product_id: "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "SUSE Enterprise Storage 7.1", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of SUSE Enterprise Storage 7.1", product_id: "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "SUSE Enterprise Storage 7.1", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of openSUSE Leap Micro 5.3", product_id: "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "openSUSE Leap Micro 5.3", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of openSUSE Leap Micro 5.3", product_id: "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "openSUSE Leap Micro 5.3", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of openSUSE Leap Micro 5.4", product_id: "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "openSUSE Leap Micro 5.4", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of openSUSE Leap Micro 5.4", product_id: "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "openSUSE Leap Micro 5.4", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.aarch64 as component of openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", }, product_reference: "shim-15.8-150300.4.20.2.aarch64", relates_to_product_reference: "openSUSE Leap 15.5", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150300.4.20.2.x86_64 as component of openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", }, product_reference: "shim-15.8-150300.4.20.2.x86_64", relates_to_product_reference: "openSUSE Leap 15.5", }, ], }, vulnerabilities: [ { cve: "CVE-2022-28737", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2022-28737", }, ], notes: [ { category: "general", text: "There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2022-28737", url: "https://www.suse.com/security/cve/CVE-2022-28737", }, { category: "external", summary: "SUSE Bug 1198458 for CVE-2022-28737", url: "https://bugzilla.suse.com/1198458", }, { category: "external", summary: "SUSE Bug 1205065 for CVE-2022-28737", url: "https://bugzilla.suse.com/1205065", }, { category: "external", summary: "SUSE Bug 1205066 for CVE-2022-28737", url: "https://bugzilla.suse.com/1205066", }, { category: "external", summary: "SUSE Bug 1205831 for CVE-2022-28737", url: "https://bugzilla.suse.com/1205831", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.4, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-22T09:06:33Z", details: "important", }, ], title: "CVE-2022-28737", }, { cve: "CVE-2023-40546", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40546", }, ], notes: [ { category: "general", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40546", url: "https://www.suse.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "SUSE Bug 1215099 for CVE-2023-40546", url: "https://bugzilla.suse.com/1215099", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-22T09:06:33Z", details: "moderate", }, ], title: "CVE-2023-40546", }, { cve: "CVE-2023-40547", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40547", }, ], notes: [ { category: "general", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40547", url: "https://www.suse.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "SUSE Bug 1215098 for CVE-2023-40547", url: "https://bugzilla.suse.com/1215098", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.1, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-22T09:06:33Z", details: "important", }, ], title: "CVE-2023-40547", }, { cve: "CVE-2023-40548", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40548", }, ], notes: [ { category: "general", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40548", url: "https://www.suse.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "SUSE Bug 1215100 for CVE-2023-40548", url: "https://bugzilla.suse.com/1215100", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.7, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-22T09:06:33Z", details: "moderate", }, ], title: "CVE-2023-40548", }, { cve: "CVE-2023-40549", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40549", }, ], notes: [ { category: "general", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40549", url: "https://www.suse.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "SUSE Bug 1215101 for CVE-2023-40549", url: "https://bugzilla.suse.com/1215101", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-22T09:06:33Z", details: "moderate", }, ], title: "CVE-2023-40549", }, { cve: "CVE-2023-40550", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40550", }, ], notes: [ { category: "general", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40550", url: "https://www.suse.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "SUSE Bug 1215102 for CVE-2023-40550", url: "https://bugzilla.suse.com/1215102", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.2, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-22T09:06:33Z", details: "moderate", }, ], title: "CVE-2023-40550", }, { cve: "CVE-2023-40551", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40551", }, ], notes: [ { category: "general", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40551", url: "https://www.suse.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "SUSE Bug 1215103 for CVE-2023-40551", url: "https://bugzilla.suse.com/1215103", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Enterprise Storage 7.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.1:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.2:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.4:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Micro 5.5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Module for Basesystem 15 SP5:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP3-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.aarch64", "SUSE Linux Enterprise Server 15 SP4-LTSS:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP3:shim-15.8-150300.4.20.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP4:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Proxy 4.3:shim-15.8-150300.4.20.2.x86_64", "SUSE Manager Server 4.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap 15.5:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.3:shim-15.8-150300.4.20.2.x86_64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.aarch64", "openSUSE Leap Micro 5.4:shim-15.8-150300.4.20.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-22T09:06:33Z", details: "moderate", }, ], title: "CVE-2023-40551", }, ], }
suse-su-2024:1461-1
Vulnerability from csaf_suse
Published
2024-04-29 11:19
Modified
2024-04-29 11:19
Summary
Security update for shim
Notes
Title of the patch
Security update for shim
Description of the patch
This update for shim fixes the following issues:
- Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)
- Limit the requirement of fde-tpm-helper-macros to the distro with
suse_version 1600 and above (bsc#1219460)
Update to version 15.8:
Security issues fixed:
- mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)
- avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)
- Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)
- Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)
- pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)
- pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)
The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now.
- Generate dbx during build so we don't include binary files in sources
- Don't require grub so shim can still be used with systemd-boot
- Update shim-install to fix boot failure of ext4 root file system
on RAID10 (bsc#1205855)
- Adopt the macros from fde-tpm-helper-macros to update the
signature in the sealed key after a bootloader upgrade
- Update shim-install to amend full disk encryption support
- Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector
- Use the long name to specify the grub2 key protector
- cryptodisk: support TPM authorized policies
- Do not use tpm_record_pcrs unless the command is in command.lst
- Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to
enable the NX compatibility flag when using post-process-pe after
discussed with grub2 experts in mail. It's useful for further development
and testing. (bsc#1205588)
Patchnames
SUSE-2024-1461,SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-1461,SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-1461,SUSE-SLE-Product-SLES_SAP-15-SP2-2024-1461
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for shim", title: "Title of the patch", }, { category: "description", text: "This update for shim fixes the following issues:\n\n- Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)\n- Limit the requirement of fde-tpm-helper-macros to the distro with\n suse_version 1600 and above (bsc#1219460)\n\nUpdate to version 15.8:\n\nSecurity issues fixed:\n\n- mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)\n- avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)\n- Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)\n- Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)\n- pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)\n- pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)\n\n \nThe NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now.\n\n- Generate dbx during build so we don't include binary files in sources\n- Don't require grub so shim can still be used with systemd-boot\n- Update shim-install to fix boot failure of ext4 root file system\n on RAID10 (bsc#1205855)\n- Adopt the macros from fde-tpm-helper-macros to update the\n signature in the sealed key after a bootloader upgrade\n\n- Update shim-install to amend full disk encryption support\n - Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector\n - Use the long name to specify the grub2 key protector\n - cryptodisk: support TPM authorized policies\n - Do not use tpm_record_pcrs unless the command is in command.lst\n\n- Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to\n enable the NX compatibility flag when using post-process-pe after\n discussed with grub2 experts in mail. It's useful for further development\n and testing. (bsc#1205588)\n", title: "Description of the patch", }, { category: "details", text: "SUSE-2024-1461,SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-1461,SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-1461,SUSE-SLE-Product-SLES_SAP-15-SP2-2024-1461", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_1461-1.json", }, { category: "self", summary: "URL for SUSE-SU-2024:1461-1", url: "https://www.suse.com/support/update/announcement/2024/suse-su-20241461-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2024:1461-1", url: "https://lists.suse.com/pipermail/sle-updates/2024-April/035121.html", }, { category: "self", summary: "SUSE Bug 1198101", url: "https://bugzilla.suse.com/1198101", }, { category: "self", summary: "SUSE Bug 1205588", url: "https://bugzilla.suse.com/1205588", }, { category: "self", summary: "SUSE Bug 1205855", url: "https://bugzilla.suse.com/1205855", }, { category: "self", summary: "SUSE Bug 1210382", url: "https://bugzilla.suse.com/1210382", }, { category: "self", summary: "SUSE Bug 1213945", url: "https://bugzilla.suse.com/1213945", }, { category: "self", summary: "SUSE Bug 1215098", url: "https://bugzilla.suse.com/1215098", }, { category: "self", summary: "SUSE Bug 1215099", url: "https://bugzilla.suse.com/1215099", }, { category: "self", summary: "SUSE Bug 1215100", url: "https://bugzilla.suse.com/1215100", }, { category: "self", summary: "SUSE Bug 1215101", url: "https://bugzilla.suse.com/1215101", }, { category: "self", summary: "SUSE Bug 1215102", url: "https://bugzilla.suse.com/1215102", }, { category: "self", summary: "SUSE Bug 1215103", url: "https://bugzilla.suse.com/1215103", }, { category: "self", summary: "SUSE Bug 1219460", url: "https://bugzilla.suse.com/1219460", }, { category: "self", summary: "SUSE CVE CVE-2022-28737 page", url: "https://www.suse.com/security/cve/CVE-2022-28737/", }, { category: "self", summary: "SUSE CVE CVE-2023-40546 page", url: "https://www.suse.com/security/cve/CVE-2023-40546/", }, { category: "self", summary: "SUSE CVE CVE-2023-40547 page", url: "https://www.suse.com/security/cve/CVE-2023-40547/", }, { category: "self", summary: "SUSE CVE CVE-2023-40548 page", url: "https://www.suse.com/security/cve/CVE-2023-40548/", }, { category: "self", summary: "SUSE CVE CVE-2023-40549 page", url: "https://www.suse.com/security/cve/CVE-2023-40549/", }, { category: "self", summary: "SUSE CVE CVE-2023-40550 page", url: "https://www.suse.com/security/cve/CVE-2023-40550/", }, { category: "self", summary: "SUSE CVE CVE-2023-40551 page", url: "https://www.suse.com/security/cve/CVE-2023-40551/", }, ], title: "Security update for shim", tracking: { current_release_date: "2024-04-29T11:19:11Z", generator: { date: "2024-04-29T11:19:11Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2024:1461-1", initial_release_date: "2024-04-29T11:19:11Z", revision_history: [ { date: "2024-04-29T11:19:11Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "shim-15.8-150100.3.38.1.x86_64", product: { name: "shim-15.8-150100.3.38.1.x86_64", product_id: "shim-15.8-150100.3.38.1.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS", product: { name: "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS", product_id: "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS", product_identification_helper: { cpe: "cpe:/o:suse:sle_hpc-ltss:15:sp2", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Server 15 SP2-LTSS", product: { name: "SUSE Linux Enterprise Server 15 SP2-LTSS", product_id: "SUSE Linux Enterprise Server 15 SP2-LTSS", product_identification_helper: { cpe: "cpe:/o:suse:sles-ltss:15:sp2", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Server for SAP Applications 15 SP2", product: { name: "SUSE Linux Enterprise Server for SAP Applications 15 SP2", product_id: "SUSE Linux Enterprise Server for SAP Applications 15 SP2", product_identification_helper: { cpe: "cpe:/o:suse:sles_sap:15:sp2", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-15.8-150100.3.38.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS", product_id: "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", }, product_reference: "shim-15.8-150100.3.38.1.x86_64", relates_to_product_reference: "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150100.3.38.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS", product_id: "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", }, product_reference: "shim-15.8-150100.3.38.1.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server 15 SP2-LTSS", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-150100.3.38.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2", product_id: "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", }, product_reference: "shim-15.8-150100.3.38.1.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 15 SP2", }, ], }, vulnerabilities: [ { cve: "CVE-2022-28737", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2022-28737", }, ], notes: [ { category: "general", text: "There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2022-28737", url: "https://www.suse.com/security/cve/CVE-2022-28737", }, { category: "external", summary: "SUSE Bug 1198458 for CVE-2022-28737", url: "https://bugzilla.suse.com/1198458", }, { category: "external", summary: "SUSE Bug 1205065 for CVE-2022-28737", url: "https://bugzilla.suse.com/1205065", }, { category: "external", summary: "SUSE Bug 1205066 for CVE-2022-28737", url: "https://bugzilla.suse.com/1205066", }, { category: "external", summary: "SUSE Bug 1205831 for CVE-2022-28737", url: "https://bugzilla.suse.com/1205831", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.4, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:19:11Z", details: "important", }, ], title: "CVE-2022-28737", }, { cve: "CVE-2023-40546", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40546", }, ], notes: [ { category: "general", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40546", url: "https://www.suse.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "SUSE Bug 1215099 for CVE-2023-40546", url: "https://bugzilla.suse.com/1215099", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:19:11Z", details: "moderate", }, ], title: "CVE-2023-40546", }, { cve: "CVE-2023-40547", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40547", }, ], notes: [ { category: "general", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40547", url: "https://www.suse.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "SUSE Bug 1215098 for CVE-2023-40547", url: "https://bugzilla.suse.com/1215098", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.1, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:19:11Z", details: "important", }, ], title: "CVE-2023-40547", }, { cve: "CVE-2023-40548", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40548", }, ], notes: [ { category: "general", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40548", url: "https://www.suse.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "SUSE Bug 1215100 for CVE-2023-40548", url: "https://bugzilla.suse.com/1215100", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.7, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:19:11Z", details: "moderate", }, ], title: "CVE-2023-40548", }, { cve: "CVE-2023-40549", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40549", }, ], notes: [ { category: "general", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40549", url: "https://www.suse.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "SUSE Bug 1215101 for CVE-2023-40549", url: "https://bugzilla.suse.com/1215101", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:19:11Z", details: "moderate", }, ], title: "CVE-2023-40549", }, { cve: "CVE-2023-40550", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40550", }, ], notes: [ { category: "general", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40550", url: "https://www.suse.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "SUSE Bug 1215102 for CVE-2023-40550", url: "https://bugzilla.suse.com/1215102", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.2, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:19:11Z", details: "moderate", }, ], title: "CVE-2023-40550", }, { cve: "CVE-2023-40551", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40551", }, ], notes: [ { category: "general", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40551", url: "https://www.suse.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "SUSE Bug 1215103 for CVE-2023-40551", url: "https://bugzilla.suse.com/1215103", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server 15 SP2-LTSS:shim-15.8-150100.3.38.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 15 SP2:shim-15.8-150100.3.38.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:19:11Z", details: "moderate", }, ], title: "CVE-2023-40551", }, ], }
suse-su-2024:1462-1
Vulnerability from csaf_suse
Published
2024-04-29 11:20
Modified
2024-04-29 11:20
Summary
Security update for shim
Notes
Title of the patch
Security update for shim
Description of the patch
This update for shim fixes the following issues:
- Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)
- Limit the requirement of fde-tpm-helper-macros to the distro with
suse_version 1600 and above (bsc#1219460)
Update to version 15.8:
Security issues fixed:
- mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)
- avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)
- Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)
- Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)
- pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)
- pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)
The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now.
- Generate dbx during build so we don't include binary files in sources
- Don't require grub so shim can still be used with systemd-boot
- Update shim-install to fix boot failure of ext4 root file system
on RAID10 (bsc#1205855)
- Adopt the macros from fde-tpm-helper-macros to update the
signature in the sealed key after a bootloader upgrade
- Update shim-install to amend full disk encryption support
- Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector
- Use the long name to specify the grub2 key protector
- cryptodisk: support TPM authorized policies
- Do not use tpm_record_pcrs unless the command is in command.lst
- Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to
enable the NX compatibility flag when using post-process-pe after
discussed with grub2 experts in mail. It's useful for further development
and testing. (bsc#1205588)
Patchnames
SUSE-2024-1462,SUSE-SLE-SERVER-12-SP5-2024-1462
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for shim", title: "Title of the patch", }, { category: "description", text: "This update for shim fixes the following issues:\n\n- Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)\n- Limit the requirement of fde-tpm-helper-macros to the distro with\n suse_version 1600 and above (bsc#1219460)\n\nUpdate to version 15.8:\n\nSecurity issues fixed:\n\n- mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)\n- avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)\n- Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)\n- Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)\n- pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)\n- pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)\n\n \nThe NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now.\n\n- Generate dbx during build so we don't include binary files in sources\n- Don't require grub so shim can still be used with systemd-boot\n- Update shim-install to fix boot failure of ext4 root file system\n on RAID10 (bsc#1205855)\n- Adopt the macros from fde-tpm-helper-macros to update the\n signature in the sealed key after a bootloader upgrade\n\n- Update shim-install to amend full disk encryption support\n - Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector\n - Use the long name to specify the grub2 key protector\n - cryptodisk: support TPM authorized policies\n - Do not use tpm_record_pcrs unless the command is in command.lst\n\n- Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to\n enable the NX compatibility flag when using post-process-pe after\n discussed with grub2 experts in mail. It's useful for further development\n and testing. (bsc#1205588)\n", title: "Description of the patch", }, { category: "details", text: "SUSE-2024-1462,SUSE-SLE-SERVER-12-SP5-2024-1462", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_1462-1.json", }, { category: "self", summary: "URL for SUSE-SU-2024:1462-1", url: "https://www.suse.com/support/update/announcement/2024/suse-su-20241462-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2024:1462-1", url: "https://lists.suse.com/pipermail/sle-updates/2024-April/035120.html", }, { category: "self", summary: "SUSE Bug 1198101", url: "https://bugzilla.suse.com/1198101", }, { category: "self", summary: "SUSE Bug 1205588", url: "https://bugzilla.suse.com/1205588", }, { category: "self", summary: "SUSE Bug 1205855", url: "https://bugzilla.suse.com/1205855", }, { category: "self", summary: "SUSE Bug 1210382", url: "https://bugzilla.suse.com/1210382", }, { category: "self", summary: "SUSE Bug 1213945", url: "https://bugzilla.suse.com/1213945", }, { category: "self", summary: "SUSE Bug 1215098", url: "https://bugzilla.suse.com/1215098", }, { category: "self", summary: "SUSE Bug 1215099", url: "https://bugzilla.suse.com/1215099", }, { category: "self", summary: "SUSE Bug 1215100", url: "https://bugzilla.suse.com/1215100", }, { category: "self", summary: "SUSE Bug 1215101", url: "https://bugzilla.suse.com/1215101", }, { category: "self", summary: "SUSE Bug 1215102", url: "https://bugzilla.suse.com/1215102", }, { category: "self", summary: "SUSE Bug 1215103", url: "https://bugzilla.suse.com/1215103", }, { category: "self", summary: "SUSE Bug 1219460", url: "https://bugzilla.suse.com/1219460", }, { category: "self", summary: "SUSE CVE CVE-2022-28737 page", url: "https://www.suse.com/security/cve/CVE-2022-28737/", }, { category: "self", summary: "SUSE CVE CVE-2023-40546 page", url: "https://www.suse.com/security/cve/CVE-2023-40546/", }, { category: "self", summary: "SUSE CVE CVE-2023-40547 page", url: "https://www.suse.com/security/cve/CVE-2023-40547/", }, { category: "self", summary: "SUSE CVE CVE-2023-40548 page", url: "https://www.suse.com/security/cve/CVE-2023-40548/", }, { category: "self", summary: "SUSE CVE CVE-2023-40549 page", url: "https://www.suse.com/security/cve/CVE-2023-40549/", }, { category: "self", summary: "SUSE CVE CVE-2023-40550 page", url: "https://www.suse.com/security/cve/CVE-2023-40550/", }, { category: "self", summary: "SUSE CVE CVE-2023-40551 page", url: "https://www.suse.com/security/cve/CVE-2023-40551/", }, ], title: "Security update for shim", tracking: { current_release_date: "2024-04-29T11:20:38Z", generator: { date: "2024-04-29T11:20:38Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2024:1462-1", initial_release_date: "2024-04-29T11:20:38Z", revision_history: [ { date: "2024-04-29T11:20:38Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "shim-15.8-25.30.1.x86_64", product: { name: "shim-15.8-25.30.1.x86_64", product_id: "shim-15.8-25.30.1.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "SUSE Linux Enterprise Server 12 SP5", product: { name: "SUSE Linux Enterprise Server 12 SP5", product_id: "SUSE Linux Enterprise Server 12 SP5", product_identification_helper: { cpe: "cpe:/o:suse:sles:12:sp5", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Server for SAP Applications 12 SP5", product: { name: "SUSE Linux Enterprise Server for SAP Applications 12 SP5", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5", product_identification_helper: { cpe: "cpe:/o:suse:sles_sap:12:sp5", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "shim-15.8-25.30.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5", product_id: "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", }, product_reference: "shim-15.8-25.30.1.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5", }, { category: "default_component_of", full_product_name: { name: "shim-15.8-25.30.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", }, product_reference: "shim-15.8-25.30.1.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5", }, ], }, vulnerabilities: [ { cve: "CVE-2022-28737", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2022-28737", }, ], notes: [ { category: "general", text: "There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2022-28737", url: "https://www.suse.com/security/cve/CVE-2022-28737", }, { category: "external", summary: "SUSE Bug 1198458 for CVE-2022-28737", url: "https://bugzilla.suse.com/1198458", }, { category: "external", summary: "SUSE Bug 1205065 for CVE-2022-28737", url: "https://bugzilla.suse.com/1205065", }, { category: "external", summary: "SUSE Bug 1205066 for CVE-2022-28737", url: "https://bugzilla.suse.com/1205066", }, { category: "external", summary: "SUSE Bug 1205831 for CVE-2022-28737", url: "https://bugzilla.suse.com/1205831", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.4, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:20:38Z", details: "important", }, ], title: "CVE-2022-28737", }, { cve: "CVE-2023-40546", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40546", }, ], notes: [ { category: "general", text: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40546", url: "https://www.suse.com/security/cve/CVE-2023-40546", }, { category: "external", summary: "SUSE Bug 1215099 for CVE-2023-40546", url: "https://bugzilla.suse.com/1215099", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:20:38Z", details: "moderate", }, ], title: "CVE-2023-40546", }, { cve: "CVE-2023-40547", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40547", }, ], notes: [ { category: "general", text: "A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40547", url: "https://www.suse.com/security/cve/CVE-2023-40547", }, { category: "external", summary: "SUSE Bug 1215098 for CVE-2023-40547", url: "https://bugzilla.suse.com/1215098", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.1, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:20:38Z", details: "important", }, ], title: "CVE-2023-40547", }, { cve: "CVE-2023-40548", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40548", }, ], notes: [ { category: "general", text: "A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40548", url: "https://www.suse.com/security/cve/CVE-2023-40548", }, { category: "external", summary: "SUSE Bug 1215100 for CVE-2023-40548", url: "https://bugzilla.suse.com/1215100", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.7, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:20:38Z", details: "moderate", }, ], title: "CVE-2023-40548", }, { cve: "CVE-2023-40549", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40549", }, ], notes: [ { category: "general", text: "An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40549", url: "https://www.suse.com/security/cve/CVE-2023-40549", }, { category: "external", summary: "SUSE Bug 1215101 for CVE-2023-40549", url: "https://bugzilla.suse.com/1215101", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:20:38Z", details: "moderate", }, ], title: "CVE-2023-40549", }, { cve: "CVE-2023-40550", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40550", }, ], notes: [ { category: "general", text: "An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40550", url: "https://www.suse.com/security/cve/CVE-2023-40550", }, { category: "external", summary: "SUSE Bug 1215102 for CVE-2023-40550", url: "https://bugzilla.suse.com/1215102", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.2, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:20:38Z", details: "moderate", }, ], title: "CVE-2023-40550", }, { cve: "CVE-2023-40551", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-40551", }, ], notes: [ { category: "general", text: "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-40551", url: "https://www.suse.com/security/cve/CVE-2023-40551", }, { category: "external", summary: "SUSE Bug 1215103 for CVE-2023-40551", url: "https://bugzilla.suse.com/1215103", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 12 SP5:shim-15.8-25.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:shim-15.8-25.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-04-29T11:20:38Z", details: "moderate", }, ], title: "CVE-2023-40551", }, ], }
gsd-2023-40546
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.
Aliases
Aliases
{ GSD: { alias: "CVE-2023-40546", id: "GSD-2023-40546", }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2023-40546", ], details: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", id: "GSD-2023-40546", modified: "2023-12-13T01:20:44.157042Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2023-40546", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Red Hat Enterprise Linux 7", version: { version_data: [ { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-3.el7", versionType: "rpm", }, ], }, }, { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-1.el7", versionType: "rpm", }, ], }, }, ], }, }, { product_name: "Red Hat Enterprise Linux 8", version: { version_data: [ { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-4.el8_9", versionType: "rpm", }, ], }, }, ], }, }, { product_name: "Red Hat Enterprise Linux 8.2 Advanced Update Support", version: { version_data: [ { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8_2", versionType: "rpm", }, ], }, }, ], }, }, { product_name: "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", version: { version_data: [ { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8_2", versionType: "rpm", }, ], }, }, ], }, }, { product_name: "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", version: { version_data: [ { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8_2", versionType: "rpm", }, ], }, }, ], }, }, { product_name: "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", version: { version_data: [ { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8_4", versionType: "rpm", }, ], }, }, ], }, }, { product_name: "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", version: { version_data: [ { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8_4", versionType: "rpm", }, ], }, }, ], }, }, { product_name: "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", version: { version_data: [ { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8_4", versionType: "rpm", }, ], }, }, ], }, }, { product_name: "Red Hat Enterprise Linux 8.8 Extended Update Support", version: { version_data: [ { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8", versionType: "rpm", }, ], }, }, { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el8", versionType: "rpm", }, ], }, }, ], }, }, { product_name: "Red Hat Enterprise Linux 9", version: { version_data: [ { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-4.el9_3", versionType: "rpm", }, ], }, }, ], }, }, { product_name: "Red Hat Enterprise Linux 9.0 Extended Update Support", version: { version_data: [ { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-3.el9", versionType: "rpm", }, ], }, }, { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el9", versionType: "rpm", }, ], }, }, { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-2.el9", versionType: "rpm", }, ], }, }, ], }, }, { product_name: "Red Hat Enterprise Linux 9.2 Extended Update Support", version: { version_data: [ { version_value: "not down converted", x_cve_json_5_version_data: { defaultStatus: "affected", versions: [ { lessThan: "*", status: "unaffected", version: "0:15.8-3.el9_2", versionType: "rpm", }, ], }, }, ], }, }, ], }, vendor_name: "Red Hat", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", }, ], }, impact: { cvss: [ { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, ], }, problemtype: { problemtype_data: [ { description: [ { cweId: "CWE-476", lang: "eng", value: "NULL Pointer Dereference", }, ], }, ], }, references: { reference_data: [ { name: "https://access.redhat.com/errata/RHSA-2024:1834", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { name: "https://access.redhat.com/errata/RHSA-2024:1835", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { name: "https://access.redhat.com/errata/RHSA-2024:1873", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { name: "https://access.redhat.com/errata/RHSA-2024:1876", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { name: "https://access.redhat.com/errata/RHSA-2024:1883", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { name: "https://access.redhat.com/errata/RHSA-2024:1902", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { name: "https://access.redhat.com/errata/RHSA-2024:1903", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { name: "https://access.redhat.com/errata/RHSA-2024:1959", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { name: "https://access.redhat.com/security/cve/CVE-2023-40546", refsource: "MISC", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { name: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", refsource: "MISC", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, ], }, work_around: [ { lang: "en", value: "There's no available mitigation for this issue.", }, ], }, "nvd.nist.gov": { cve: { configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:redhat:shim:*:*:*:*:*:*:*:*", matchCriteriaId: "01639865-3664-4034-BCFB-F4E09AF37F28", versionEndExcluding: "15.8", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*", matchCriteriaId: "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646", vulnerable: true, }, { criteria: "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", matchCriteriaId: "F4CFF558-3C47-480D-A2F0-BABF26042943", vulnerable: true, }, { criteria: "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", matchCriteriaId: "7F6FB57C-2BC7-487C-96DD-132683AEB35D", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], descriptions: [ { lang: "en", value: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", }, { lang: "es", value: "Se encontró un fallo en Shim cuando ocurrió un error al crear una nueva variable ESL. Si Shim no puede crear la nueva variable, intenta imprimir un mensaje de error para el usuario; sin embargo, la cantidad de parámetros utilizados por la función de registro no coincide con la cadena de formato utilizada, lo que provoca un bloqueo en determinadas circunstancias.", }, ], id: "CVE-2023-40546", lastModified: "2024-04-25T14:15:08.297", metrics: { cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, exploitabilityScore: 1.8, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, exploitabilityScore: 2.5, impactScore: 3.6, source: "secalert@redhat.com", type: "Secondary", }, ], }, published: "2024-01-29T17:15:08.347", references: [ { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { source: "secalert@redhat.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, ], sourceIdentifier: "secalert@redhat.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-476", }, ], source: "nvd@nist.gov", type: "Primary", }, { description: [ { lang: "en", value: "CWE-476", }, ], source: "secalert@redhat.com", type: "Secondary", }, ], }, }, }, }
ghsa-9fh5-955w-9jfh
Vulnerability from github
Published
2024-01-29 18:31
Modified
2024-06-10 18:30
Severity ?
Details
A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.
{ affected: [], aliases: [ "CVE-2023-40546", ], database_specific: { cwe_ids: [ "CWE-476", ], github_reviewed: false, github_reviewed_at: null, nvd_published_at: "2024-01-29T17:15:08Z", severity: "MODERATE", }, details: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", id: "GHSA-9fh5-955w-9jfh", modified: "2024-06-10T18:30:52Z", published: "2024-01-29T18:31:50Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-40546", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { type: "WEB", url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { type: "WEB", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { type: "WEB", url: "https://lists.debian.org/debian-lts-announce/2024/05/msg00009.html", }, ], schema_version: "1.4.0", severity: [ { score: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", type: "CVSS_V3", }, ], }
fkie_cve-2023-40546
Vulnerability from fkie_nvd
Published
2024-01-29 17:15
Modified
2024-11-21 08:19
Severity ?
6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| redhat | shim | * | |
| fedoraproject | fedora | 39 | |
| redhat | enterprise_linux | 8.0 | |
| redhat | enterprise_linux | 9.0 |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:redhat:shim:*:*:*:*:*:*:*:*", matchCriteriaId: "01639865-3664-4034-BCFB-F4E09AF37F28", versionEndExcluding: "15.8", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*", matchCriteriaId: "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646", vulnerable: true, }, { criteria: "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", matchCriteriaId: "F4CFF558-3C47-480D-A2F0-BABF26042943", vulnerable: true, }, { criteria: "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", matchCriteriaId: "7F6FB57C-2BC7-487C-96DD-132683AEB35D", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.", }, { lang: "es", value: "Se encontró un fallo en Shim cuando ocurrió un error al crear una nueva variable ESL. Si Shim no puede crear la nueva variable, intenta imprimir un mensaje de error para el usuario; sin embargo, la cantidad de parámetros utilizados por la función de registro no coincide con la cadena de formato utilizada, lo que provoca un bloqueo en determinadas circunstancias.", }, ], id: "CVE-2023-40546", lastModified: "2024-11-21T08:19:41.450", metrics: { cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, exploitabilityScore: 2.5, impactScore: 3.6, source: "secalert@redhat.com", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, exploitabilityScore: 1.8, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2024-01-29T17:15:08.347", references: [ { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { source: "secalert@redhat.com", url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { source: "secalert@redhat.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://access.redhat.com/errata/RHSA-2024:1834", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://access.redhat.com/errata/RHSA-2024:1835", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://access.redhat.com/errata/RHSA-2024:1873", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://access.redhat.com/errata/RHSA-2024:1876", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://access.redhat.com/errata/RHSA-2024:1883", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://access.redhat.com/errata/RHSA-2024:1902", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://access.redhat.com/errata/RHSA-2024:1903", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://access.redhat.com/errata/RHSA-2024:1959", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://access.redhat.com/errata/RHSA-2024:2086", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/security/cve/CVE-2023-40546", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=2241796", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.debian.org/debian-lts-announce/2024/05/msg00009.html", }, ], sourceIdentifier: "secalert@redhat.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-476", }, ], source: "secalert@redhat.com", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-476", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.