Vulnerability-Lookup

SUSE-SU-2023:2150-1

Vulnerability from csaf_suse - Published: 2023-05-09 15:34 - Updated: 2026-09-20 15:04

Summary

Security update for shim

Severity

Important

Notes

Title of the patch: Security update for shim

Description of the patch: This update for shim fixes the following issues: - Updated shim signature after shim 15.7 be signed back: signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458) - Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe because grub2 is not ready. (bsc#1205588) - Enable the NX compatibility flag by default. (jsc#PED-127) Update to 15.7 (bsc#1198458) (jsc#PED-127): - Make SBAT variable payload introspectable - Reference MokListRT instead of MokList - Add a link to the test plan in the readme. - [V3] Enable TDX measurement to RTMR register - Discard load-options that start with a NUL - Fixed load_cert_file bugs - Add -malign-double to IA32 compiler flags - pe: Fix image section entry-point validation - make-archive: Build reproducible tarball - mok: remove MokListTrusted from PCR 7 Other fixes: - Support enhance shim measurement to TD RTMR. (jsc#PED-1273) - shim-install: ensure grub.cfg created is not overwritten after installing grub related files - Add logic to shim.spec to only set sbat policy when efivarfs is writeable. (bsc#1201066) - Add logic to shim.spec for detecting --set-sbat-policy option before using mokutil to set sbat policy. (bsc#1202120) - Change the URL in SBAT section to mail:security@suse.de. (bsc#1193282) Update to 15.6 (bsc#1198458): - MokManager: removed Locate graphic output protocol fail error message - shim: implement SBAT verification for the shim_lock protocol - post-process-pe: Fix a missing return code check - Update github actions matrix to be more useful - post-process-pe: Fix format string warnings on 32-bit platforms - Allow MokListTrusted to be enabled by default - Re-add ARM AArch64 support - Use ASCII as fallback if Unicode Box Drawing characters fail - make: don't treat cert.S specially - shim: use SHIM_DEVEL_VERBOSE when built in devel mode - Break out of the inner sbat loop if we find the entry. - Support loading additional certificates - Add support for NX (W^X) mitigations. - Fix preserve_sbat_uefi_variable() logic - SBAT Policy latest should be a one-shot - pe: Fix a buffer overflow when SizeOfRawData > VirtualSize - pe: Perform image verification earlier when loading grub - Update advertised sbat generation number for shim - Update SBAT generation requirements for 05/24/22 - Also avoid CVE-2022-28737 in verify_image() by @vathpela Update to 15.5 (bsc#1198458): - Broken ia32 relocs and an unimportant submodule change. - mok: allocate MOK config table as BootServicesData - Don't call QueryVariableInfo() on EFI 1.10 machines (bsc#1187260) - Relax the check for import_mok_state() (bsc#1185261) - SBAT.md: trivial changes - shim: another attempt to fix load options handling - Add tests for our load options parsing. - arm/aa64: fix the size of .rela* sections - mok: fix potential buffer overrun in import_mok_state - mok: relax the maximum variable size check - Don't unhook ExitBootServices when EBS protection is disabled - fallback: find_boot_option() needs to return the index for the boot entry in optnum - httpboot: Ignore case when checking HTTP headers - Fallback allocation errors - shim: avoid BOOTx64.EFI in message on other architectures - str: remove duplicate parameter check - fallback: add compile option FALLBACK_NONINTERACTIVE - Test mok mirror - Modify sbat.md to help with readability. - csv: detect end of csv file correctly - Specify that the .sbat section is ASCII not UTF-8 - tests: add 'include-fixed' GCC directory to include directories - pe: simplify generate_hash() - Don't make shim abort when TPM log event fails (RHBZ #2002265) - Fallback to default loader if parsed one does not exist - fallback: Fix for BootOrder crash when index returned - Better console checks - docs: update SBAT UEFI variable name - Don't parse load options if invoked from removable media path - fallback: fix fallback not passing arguments of the first boot option - shim: Don't stop forever at 'Secure Boot not enabled' notification - Allocate mokvar table in runtime memory. - Remove post-process-pe on 'make clean' - pe: missing perror argument - CVE-2022-28737: Fixed a buffer overflow when SizeOfRawData > VirtualSize (bsc#1198458) - Add mokutil command to post script for setting sbat policy to latest mode when the SbatPolicy-605dab50-e046-4300-abb6-3dd810dd8b23 is not created. (bsc#1198458) - Updated vendor dbx binary and script (bsc#1198458) - Updated dbx-cert.tar.xz and vendor-dbx-sles.bin for adding SLES-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list. - Updated dbx-cert.tar.xz and vendor-dbx-opensuse.bin for adding openSUSE-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list. - Updated vendor-dbx.bin for adding SLES-UEFI-SIGN-Certificate-2021-05.crt and openSUSE-UEFI-SIGN-Certificate-2021-05.crt for testing environment. - Updated generate-vendor-dbx.sh script for generating a vendor-dbx.bin file which includes all .der for testing environment. - avoid buffer overflow when copying data to the MOK config table (bsc#1185232) - Disable exporting vendor-dbx to MokListXRT since writing a large RT variable could crash some machines (bsc#1185261) - ignore the odd LoadOptions length (bsc#1185232) - shim-install: reset def_shim_efi to 'shim.efi' if the given file doesn't exist - relax the maximum variable size check for u-boot (bsc#1185621) - handle ignore_db and user_insecure_mode correctly (bsc#1185441, bsc#1187071) - Split the keys in vendor-dbx.bin to vendor-dbx-sles and vendor-dbx-opensuse for shim-sles and shim-opensuse to reduce the size of MokListXRT (bsc#1185261) + Also update generate-vendor-dbx.sh in dbx-cert.tar.xz Update shim to 15.4-4.7.1, Version: 15.4, 'Thu Jul 15 2021' - Update the SLE signatures - Includes fixes for MOK and boot problems (bsc#1187696, bsc#1185261, bsc#1185441, bsc#1187071, bsc#1185621, bsc#1185261, bsc#1185232, bsc#1185261, bsc#1187260, bsc#1185232)

Patchnames: SUSE-2023-2150,SUSE-SLE-SERVER-12-SP2-BCL-2023-2150

CVE-2022-28737

8.4 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 2 products

Product	Identifier	Version	Remediation
Unresolved product id: SUSE Linux Enterprise High Performance Computing 12 SP2:shim-0:15.7-22.15.1.x86_64		—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2-BCL:shim-0:15.7-22.15.1.x86_64		—	Vendor Fix

Threats

Impact important

References

22 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2023…	self
https://bugzilla.suse.com/1185232	self
https://bugzilla.suse.com/1185261	self
https://bugzilla.suse.com/1185441	self
https://bugzilla.suse.com/1185621	self
https://bugzilla.suse.com/1187071	self
https://bugzilla.suse.com/1187260	self
https://bugzilla.suse.com/1187696	self
https://bugzilla.suse.com/1193282	self
https://bugzilla.suse.com/1198458	self
https://bugzilla.suse.com/1201066	self
https://bugzilla.suse.com/1202120	self
https://bugzilla.suse.com/1205588	self
https://www.suse.com/security/cve/CVE-2022-28737/	self
https://www.suse.com/security/cve/CVE-2022-28737	external
https://bugzilla.suse.com/1198458	external
https://bugzilla.suse.com/1205065	external
https://bugzilla.suse.com/1205066	external
https://bugzilla.suse.com/1205831	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for shim",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for shim fixes the following issues:\n\n- Updated shim signature after shim 15.7 be signed back:\n  signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458)\n\n- Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to\n  disable the NX compatibility flag when using post-process-pe because\n  grub2 is not ready. (bsc#1205588)\n\n- Enable the NX compatibility flag by default. (jsc#PED-127) \n\nUpdate to 15.7 (bsc#1198458) (jsc#PED-127):\n\n- Make SBAT variable payload introspectable\n- Reference MokListRT instead of MokList\n- Add a link to the test plan in the readme.\n- [V3] Enable TDX measurement to RTMR register\n- Discard load-options that start with a NUL\n- Fixed load_cert_file bugs\n- Add -malign-double to IA32 compiler flags\n- pe: Fix image section entry-point validation\n- make-archive: Build reproducible tarball\n- mok: remove MokListTrusted from PCR 7\n\nOther fixes:\n\n- Support enhance shim measurement to TD RTMR. (jsc#PED-1273) \n\n- shim-install: ensure grub.cfg created is not overwritten after installing grub related files\n- Add logic to shim.spec to only set sbat policy when efivarfs is writeable.  (bsc#1201066)\n- Add logic to shim.spec for detecting --set-sbat-policy option before using mokutil to set sbat policy. (bsc#1202120)\n- Change the URL in SBAT section to mail:security@suse.de. (bsc#1193282)\n\nUpdate to 15.6 (bsc#1198458):\n\n- MokManager: removed Locate graphic output protocol fail error message\n- shim: implement SBAT verification for the shim_lock protocol\n- post-process-pe: Fix a missing return code check\n- Update github actions matrix to be more useful\n- post-process-pe: Fix format string warnings on 32-bit platforms\n- Allow MokListTrusted to be enabled by default\n- Re-add ARM AArch64 support\n- Use ASCII as fallback if Unicode Box Drawing characters fail\n- make: don\u0027t treat cert.S specially\n- shim: use SHIM_DEVEL_VERBOSE when built in devel mode\n- Break out of the inner sbat loop if we find the entry.\n- Support loading additional certificates\n- Add support for NX (W^X) mitigations.\n- Fix preserve_sbat_uefi_variable() logic\n- SBAT Policy latest should be a one-shot\n- pe: Fix a buffer overflow when SizeOfRawData \u003e VirtualSize\n- pe: Perform image verification earlier when loading grub\n- Update advertised sbat generation number for shim\n- Update SBAT generation requirements for 05/24/22\n- Also avoid CVE-2022-28737 in verify_image() by @vathpela\n\nUpdate to 15.5 (bsc#1198458):\n\n- Broken ia32 relocs and an unimportant submodule change.\n- mok: allocate MOK config table as BootServicesData\n- Don\u0027t call QueryVariableInfo() on EFI 1.10 machines (bsc#1187260)\n- Relax the check for import_mok_state()  (bsc#1185261)\n- SBAT.md: trivial changes\n- shim: another attempt to fix load options handling\n- Add tests for our load options parsing.\n- arm/aa64: fix the size of .rela* sections\n- mok: fix potential buffer overrun in import_mok_state\n- mok: relax the maximum variable size check\n- Don\u0027t unhook ExitBootServices when EBS protection is disabled\n- fallback: find_boot_option() needs to return the index for the boot entry in optnum\n- httpboot: Ignore case when checking HTTP headers\n- Fallback allocation errors\n- shim: avoid BOOTx64.EFI in message on other architectures\n- str: remove duplicate parameter check\n- fallback: add compile option FALLBACK_NONINTERACTIVE\n- Test mok mirror\n- Modify sbat.md to help with readability.\n- csv: detect end of csv file correctly\n- Specify that the .sbat section is ASCII not UTF-8\n- tests: add \u0027include-fixed\u0027 GCC directory to include directories\n- pe: simplify generate_hash()\n- Don\u0027t make shim abort when TPM log event fails (RHBZ #2002265)\n- Fallback to default loader if parsed one does not exist\n- fallback: Fix for BootOrder crash when index returned\n- Better console checks\n- docs: update SBAT UEFI variable name\n- Don\u0027t parse load options if invoked from removable media path\n- fallback: fix fallback not passing arguments of the first boot option\n- shim: Don\u0027t stop forever at \u0027Secure Boot not enabled\u0027 notification\n- Allocate mokvar table in runtime memory.\n- Remove post-process-pe on \u0027make clean\u0027\n- pe: missing perror argument\n\n\n- CVE-2022-28737: Fixed a buffer overflow when SizeOfRawData \u003e VirtualSize (bsc#1198458)\n\n- Add mokutil command to post script for setting sbat policy to latest mode\n  when the SbatPolicy-605dab50-e046-4300-abb6-3dd810dd8b23 is not created.\n  (bsc#1198458)\n\n- Updated vendor dbx binary and script (bsc#1198458)\n\n  - Updated dbx-cert.tar.xz and vendor-dbx-sles.bin for adding\n    SLES-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.\n  - Updated dbx-cert.tar.xz and vendor-dbx-opensuse.bin for adding\n    openSUSE-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.\n  - Updated vendor-dbx.bin for adding SLES-UEFI-SIGN-Certificate-2021-05.crt\n    and openSUSE-UEFI-SIGN-Certificate-2021-05.crt for testing environment.\n  - Updated generate-vendor-dbx.sh script for generating a vendor-dbx.bin\n    file which includes all .der for testing environment.\n\n- avoid buffer overflow when copying data to the MOK config table (bsc#1185232)\n- Disable exporting vendor-dbx to MokListXRT since writing a large RT variable could crash some machines (bsc#1185261)\n- ignore the odd LoadOptions length (bsc#1185232)\n- shim-install: reset def_shim_efi to \u0027shim.efi\u0027 if the given file doesn\u0027t exist\n- relax the maximum variable size check for u-boot (bsc#1185621)\n- handle ignore_db and user_insecure_mode correctly (bsc#1185441, bsc#1187071)\n\n- Split the keys in vendor-dbx.bin to vendor-dbx-sles and\n  vendor-dbx-opensuse for shim-sles and shim-opensuse to reduce\n  the size of MokListXRT (bsc#1185261) \n  + Also update generate-vendor-dbx.sh in dbx-cert.tar.xz\n\nUpdate shim to 15.4-4.7.1, Version: 15.4, \u0027Thu Jul 15 2021\u0027\n\n- Update the SLE signatures\n- Includes fixes for MOK and boot problems (bsc#1187696, bsc#1185261, bsc#1185441,\n  bsc#1187071, bsc#1185621, bsc#1185261, bsc#1185232, bsc#1185261,\n  bsc#1187260, bsc#1185232)\n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2023-2150,SUSE-SLE-SERVER-12-SP2-BCL-2023-2150",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_2150-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2023:2150-1",
        "url": "https://www.suse.com/support/update/announcement/2023/suse-su-20232150-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2023:2150-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2023-May/029298.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1185232",
        "url": "https://bugzilla.suse.com/1185232"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1185261",
        "url": "https://bugzilla.suse.com/1185261"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1185441",
        "url": "https://bugzilla.suse.com/1185441"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1185621",
        "url": "https://bugzilla.suse.com/1185621"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187071",
        "url": "https://bugzilla.suse.com/1187071"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187260",
        "url": "https://bugzilla.suse.com/1187260"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187696",
        "url": "https://bugzilla.suse.com/1187696"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1193282",
        "url": "https://bugzilla.suse.com/1193282"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1198458",
        "url": "https://bugzilla.suse.com/1198458"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1201066",
        "url": "https://bugzilla.suse.com/1201066"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1202120",
        "url": "https://bugzilla.suse.com/1202120"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1205588",
        "url": "https://bugzilla.suse.com/1205588"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-28737 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-28737/"
      }
    ],
    "title": "Security update for shim",
    "tracking": {
      "current_release_date": "2026-09-20T15:04:23Z",
      "generator": {
        "date": "2023-05-09T15:34:27Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2023:2150-1",
      "initial_release_date": "2023-05-09T15:34:27Z",
      "revision_history": [
        {
          "date": "2023-05-09T15:34:27Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T15:04:23Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shim-0:15.7-22.15.1.x86_64",
                "product": {
                  "name": "shim-0:15.7-22.15.1.x86_64",
                  "product_id": "shim-0:15.7-22.15.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:redhat:shim:15.7:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/shim@15.7-22.15.1?arch=x86_64\u0026upstream=shim-0:15.7-22.15.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP2-BCL",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP2-BCL",
                  "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-bcl:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 12 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 12 SP2",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 12 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-hpc:12:sp2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-0:15.7-22.15.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:shim-0:15.7-22.15.1.x86_64"
        },
        "product_reference": "shim-0:15.7-22.15.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shim-0:15.7-22.15.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL",
          "product_id": "SUSE Linux Enterprise High Performance Computing 12 SP2:shim-0:15.7-22.15.1.x86_64"
        },
        "product_reference": "shim-0:15.7-22.15.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 12 SP2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-28737",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-28737"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "There\u0027s a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 12 SP2:shim-0:15.7-22.15.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP2-BCL:shim-0:15.7-22.15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-28737",
          "url": "https://www.suse.com/security/cve/CVE-2022-28737"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1198458 for CVE-2022-28737",
          "url": "https://bugzilla.suse.com/1198458"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1205065 for CVE-2022-28737",
          "url": "https://bugzilla.suse.com/1205065"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1205066 for CVE-2022-28737",
          "url": "https://bugzilla.suse.com/1205066"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1205831 for CVE-2022-28737",
          "url": "https://bugzilla.suse.com/1205831"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 12 SP2:shim-0:15.7-22.15.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:shim-0:15.7-22.15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 12 SP2:shim-0:15.7-22.15.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP2-BCL:shim-0:15.7-22.15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-05-09T15:34:27Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-28737"
    }
  ]
}

CVE-2022-28737 (GCVE-0-2022-28737)

Vulnerability from cvelistv5 – Published: 2023-07-20 00:26 – Updated: 2024-10-22 13:17

Title

There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables

Summary

There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-22 13:15 UTC

Assigner

canonical mitre root Scorecard

References

2 references

URL	Tags
https://www.openwall.com/lists/oss-security/2022/…	mailing-list
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CV…	issue-tracking

Impacted products

2 products

Vendor	Product	Version
Red Hat Bootloader Team	shim	Affected: 0 , < 15.6 (semver)
redhat	shim	Affected: 0 , < 15.6 (semver) cpe:2.3:a:redhat:shim::::::::

Date Public

2022-06-13 00:00

Credits

Chris Coulson

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:03:52.700Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2022/06/07/5"
          },
          {
            "tags": [
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28737"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:redhat:shim:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "shim",
            "vendor": "redhat",
            "versions": [
              {
                "lessThan": "15.6",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-28737",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:15:51.434701Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:17:50.789Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "packageName": "shim",
          "platforms": [
            "Linux"
          ],
          "product": "shim",
          "repo": "https://github.com/rhboot/shim/",
          "vendor": "Red Hat Bootloader Team",
          "versions": [
            {
              "lessThan": "15.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Chris Coulson"
        }
      ],
      "datePublic": "2022-06-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "There\u0027s a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-20T15:38:14.142Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "mailing-list"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2022/06/07/5"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28737"
        }
      ],
      "title": "There\u0027s a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2022-28737",
    "datePublished": "2023-07-20T00:26:15.627Z",
    "dateReserved": "2022-04-05T21:59:08.761Z",
    "dateUpdated": "2024-10-22T13:17:50.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2023:2150-1

CVE-2022-28737 (GCVE-0-2022-28737)

Tags

Sightings

Nomenclature

Related by attack behaviour