CVE-2023-40548: Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems
A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.
Other sources
An integer overflow issue exists in shim when compiled for 32-bit processors. The issue is due to performing addition on a user-controlled value parsed from the PE being loaded without verifying that the result of the addition does not overflow. The overflowed value is passed as a size to AllocatePool, and then the resulting buffer is copied to using the original value, resulting in a buffer overflow.
— Red Hat
rhboot shim could allow a local attacker to execute arbitrary code on the system, caused by an integer overflow leads to a heap-based buffer overflow in verifysbatsection on 32-bits systems. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/shimto a version that resolves this vulnerability.Fixed in 15.8
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40548?
CVE-2023-40548 is classified as a critical vulnerability due to the potential for a heap-based buffer overflow.
How do I fix CVE-2023-40548?
To mitigate CVE-2023-40548, you should upgrade to the latest version of Shim, specifically version 15.8 or higher.
What software is affected by CVE-2023-40548?
CVE-2023-40548 affects the Shim package in Red Hat and Fedora systems, specifically versions up to 15.8 and 39 respectively.
What risks does CVE-2023-40548 pose to my system?
Exploiting CVE-2023-40548 could allow an attacker to execute arbitrary code on the affected systems, compromising their integrity.
Is there a workaround for CVE-2023-40548?
Yes, temporarily restricting access to the affected Shim package can act as a workaround until a proper update is applied.