rhboot shim up to 15.7 on ARM mok mok.c mirror_one_esl format string

Summaryinfo

A vulnerability was found in rhboot shim up to 15.7 on ARM. It has been classified as critical. This affects the function mirror_one_esl of the file mok.c of the component mok. Performing a manipulation results in format string. This vulnerability is identified as CVE-2023-40546. There is not any exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability classified as critical has been found in rhboot shim up to 15.7 on ARM. This affects the function mirror_one_esl of the file mok.c of the component mok. The manipulation with an unknown input leads to a format string vulnerability. CWE is classifying the issue as CWE-134. The product uses a function that accepts a format string as an argument, but the format string originates from an external source. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.

The weakness was released 10/28/2023. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2023-40546 since 08/15/2023. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 215406 (Azure Linux 3.0 Security Update: shim / shim-unsigned-aarch64 / shim-unsigned-x64 (CVE-2023-40546)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 66e6579dbf921152f647a0c16da1d3b2f40861ca is able to eliminate this problem. The bugfix is ready for download at github.com. The advisory contains the following remark:

On some ARM platform, jlinton noticed that when we fail to set a variable (because it isn't supported at all, presumably), our error message has an extra argument that doesn't match the format string.

The vulnerability is also documented in the databases at Tenable (215406) and EUVD (EUVD-2023-45117). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• rhboot

Name

• shim

Version

• 15.0
• 15.1
• 15.2
• 15.3
• 15.4
• 15.5
• 15.6
• 15.7

License

• open-source

Website

• Product: https://github.com/rhboot/shim/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion