CVE-2022-28737

NameCVE-2022-28737
DescriptionThere's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
shim (PTS)buster15.4-7~deb10u1vulnerable
buster (security)15.8-1~deb10u1fixed
bullseye15.7-1~deb11u1fixed
trixie, bookworm15.7-1fixed
sid15.8-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
shimsourcebullseye15.6-1~deb11u1
shimsource(unstable)15.6-1

Notes

[buster] - shim <no-dsa> (Fix via point update)
https://www.openwall.com/lists/oss-security/2022/06/07/5
https://github.com/rhboot/shim/commit/e99bdbb827a50cde019393d3ca1e89397db221a7 (15.6)
https://github.com/rhboot/shim/commit/159151b6649008793d6204a34d7b9c41221fb4b0 (15.6)

Search for package or bug name: Reporting problems