CVE-2022-28737: There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables
A flaw was found in shim during the handling of EFI executables. A crafted EFI image can lead to an overflow in shim. This flaw allows an attacker to perform an out-of-bounds write in memory. A successful attack can lead to data integrity, confidentiality issues, and arbitrary code execution.
Other sources
There's a possible overflow in handleimage() when shim tries to load and execute crafted EFI executables; The handleimage() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.
There's a possible overflow in handleimage() when shim tries to load and execute crafted EFI executables. The handleimage() function takes in account by the SizeOfRawData field from each section to be load, an attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/shimto a version that resolves this vulnerability.Fixed in 15.6 - Upgrade
Upgrade
redhat/shimto a version that resolves this vulnerability.Fixed in 0:15.6-1.el8 - Upgrade
Upgrade
redhat/shim-unsigned-x64to a version that resolves this vulnerability.Fixed in 0:15.6-1.el8 - Upgrade
Upgrade
redhat/shimto a version that resolves this vulnerability.Fixed in 0:15.6-1.el9 - Upgrade
Upgrade
redhat/shim-unsigned-x64to a version that resolves this vulnerability.Fixed in 0:15.6-1.el9 - Upgrade
Upgrade
redhat/shimto a version that resolves this vulnerability.Fixed in 15.6 - Upgrade
Upgrade
debian/shimto a version that resolves this vulnerability.Fixed in 16.1-2~deb12u1Fixed in 16.1-2~deb13u1Fixed in 16.1-2 - Upgrade
Upgrade
debian/shimto a version that resolves this vulnerability.Fixed in 15.6-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-28737?
CVE-2022-28737 is a vulnerability in shim that allows an attacker to perform out-of-bounds writes into memory by leveraging a crafted EFI image.
What is the severity of CVE-2022-28737?
The severity of CVE-2022-28737 is high with a CVSS score of 7.8.
Which software is affected by CVE-2022-28737?
The Red Hat Shim package versions up to 15.6, Red Hat Shim Unsigned x64 package versions up to 15.6, Red Hat Shim package versions up to 15.6 on el8, Red Hat Shim Unsigned x64 package versions up to 15.6 on el8, Red Hat Shim package versions up to 15.6 on el9, Red Hat Shim Unsigned x64 package versions up to 15.6 on el9, Ubuntu Shim package versions up to 15.6, and Debian Shim package versions up to 15.4-7~deb10u1 are affected by CVE-2022-28737.
How can an attacker exploit CVE-2022-28737?
An attacker can exploit CVE-2022-28737 by using a crafted EFI image to perform out-of-bounds writes into memory.
Is there a fix available for CVE-2022-28737?
Yes, the remedy for CVE-2022-28737 is to update to Red Hat Shim package version 15.6 or later, Red Hat Shim Unsigned x64 package version 15.6 or later, Ubuntu Shim package version 15.6 or later, or Debian Shim package version 15.7-1~deb10u1 or later.