A critical vulnerability, CVE-2023-40547, has been identified in the shim boot loader, impacting a wide range of Linux distributions including Debian, Red Hat, SUSE, and Ubuntu. This vulnerability, with a CVSS score of 9.8, enables attackers to bypass Secure Boot and potentially execute remote code. Discovered by Bill Demirkapi of the Microsoft Security Response Center (MSRC), this flaw is part of six security issues addressed in the newly released shim version 15.8.
Vulnerability Details
- CVE ID: CVE-2023-40547
- CVSS Score: 9.8
- Impact: Allows Secure Boot bypass and remote code execution.
- Affected Component: Shim’s http boot support (httpboot.c).
- Description: The vulnerability arises from improper handling of attacker-controlled values when parsing an HTTP response, leading to an out-of-bounds write that can result in complete system compromise.
Attack Scenario and Exploitation
The flaw can be exploited in environments where attackers have network access, enabling them to conduct Man-in-the-Middle (MiTM) attacks to intercept HTTP traffic and load a vulnerable shim bootloader. This grants attackers early control in the boot process, potentially allowing the deployment of bootkits that could provide near-total control over the compromised system.
Other Vulnerabilities Addressed
Alongside CVE-2023-40547, shim version 15.8 also patches additional vulnerabilities:
- CVE-2023-40546: Denial-of-Service (DoS) via out-of-bounds read when printing error messages.
- CVE-2023-40548: Buffer overflow in 32-bit compiled shim leading to boot phase crashes or data integrity issues.
- CVE-2023-40549: DoS through an out-of-bounds read in the authenticode function.
- CVE-2023-40550: Potential information disclosure from out-of-bounds read when validating SBAT information.
- CVE-2023-40551: Crash or sensitive data exposure from out-of-bounds read when parsing MZ binaries.
Response and Mitigation
Major Linux distributions have issued advisories urging users to update to shim version 15.8 immediately. This update is crucial for mitigating the risk posed by CVE-2023-40547 and the associated vulnerabilities, ensuring the security of the boot process and protecting against potential system compromises.
Conclusion
The discovery of CVE-2023-40547 highlights the critical importance of maintaining secure boot mechanisms and the potential risks posed by vulnerabilities in foundational system components. Organizations and users of affected Linux distributions should prioritize the application of these patches to defend against the exploitation of these vulnerabilities and safeguard their systems against advanced persistent threats.
Stay vigilant and ensure your systems are updated,
OP Innovate.
