CVE-2022-28737

Name	CVE-2022-28737
Description	There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
shim (PTS)	bullseye	15.8-1~deb11u1	fixed
	bookworm	15.8-1~deb12u1	fixed
	forky, sid, trixie	15.8-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
shim	source	bullseye	15.6-1~deb11u1
shim	source	(unstable)	15.6-1

Notes

[buster] - shim <no-dsa> (Fix via point update)
https://www.openwall.com/lists/oss-security/2022/06/07/5
https://github.com/rhboot/shim/commit/e99bdbb827a50cde019393d3ca1e89397db221a7 (15.6)
https://github.com/rhboot/shim/commit/159151b6649008793d6204a34d7b9c41221fb4b0 (15.6)