Anolis OS update for shim and shim-signed



Risk High
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2023-40546
CVE-2023-40547
CVE-2023-40548
CVE-2023-40549
CVE-2023-40550
CVE-2023-40551
CWE-ID CWE-476
CWE-345
CWE-190
CWE-125
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Anolis OS
Operating systems & Components / Operating system

shim-x64
Operating systems & Components / Operating system package or component

shim-unsigned-x64
Operating systems & Components / Operating system package or component

shim-unsigned-ia32
Operating systems & Components / Operating system package or component

shim-ia32
Operating systems & Components / Operating system package or component

shim-aa64
Operating systems & Components / Operating system package or component

mokutil
Operating systems & Components / Operating system package or component

Vendor OpenAnolis

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) NULL pointer dereference

EUVDB-ID: #VU86241

Risk: Medium

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-40546

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the mirror_one_esl() function in mok.c while creating a new ESL variable. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 7

shim-x64: before 15.8-1.0.1

shim-unsigned-x64: before 15.8-3.0.1

shim-unsigned-ia32: before 15.8-3.0.1

shim-ia32: before 15.8-1.0.1

shim-aa64: before 15.8-1.0.1

mokutil: before 15.8-1.0.1

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0530


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Insufficient verification of data authenticity

EUVDB-ID: #VU86236

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-40547

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing verification of data authenticity when parsing HTTP responses. A remote attacker can perform a man-in-the-middle (MitM) attack and use a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise.

This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 7

shim-x64: before 15.8-1.0.1

shim-unsigned-x64: before 15.8-3.0.1

shim-unsigned-ia32: before 15.8-3.0.1

shim-ia32: before 15.8-1.0.1

shim-aa64: before 15.8-1.0.1

mokutil: before 15.8-1.0.1

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0530


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Integer overflow

EUVDB-ID: #VU86237

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-40548

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the verify_sbat_section on 32-bits systems. A remote attacker can pass a specially crafted PE binary to the application, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 7

shim-x64: before 15.8-1.0.1

shim-unsigned-x64: before 15.8-3.0.1

shim-unsigned-ia32: before 15.8-3.0.1

shim-ia32: before 15.8-1.0.1

shim-aa64: before 15.8-1.0.1

mokutil: before 15.8-1.0.1

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0530


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds read

EUVDB-ID: #VU86238

Risk: Medium

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-40549

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the verify_buffer_authenticode()  function when parsing PE binary. A remote attacker can pass a specially crafted PE binary to the loader, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 7

shim-x64: before 15.8-1.0.1

shim-unsigned-x64: before 15.8-3.0.1

shim-unsigned-ia32: before 15.8-3.0.1

shim-ia32: before 15.8-1.0.1

shim-aa64: before 15.8-1.0.1

mokutil: before 15.8-1.0.1

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0530


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU86239

Risk: Medium

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-40550

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the verify_buffer_sbat() function. A remote attacker can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 7

shim-x64: before 15.8-1.0.1

shim-unsigned-x64: before 15.8-3.0.1

shim-unsigned-ia32: before 15.8-3.0.1

shim-ia32: before 15.8-1.0.1

shim-aa64: before 15.8-1.0.1

mokutil: before 15.8-1.0.1

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0530


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds read

EUVDB-ID: #VU86240

Risk: Medium

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-40551

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition when parsing MZ binaries. A remote attacker can pass a specially crafted MZ binary to the application, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 7

shim-x64: before 15.8-1.0.1

shim-unsigned-x64: before 15.8-3.0.1

shim-unsigned-ia32: before 15.8-3.0.1

shim-ia32: before 15.8-1.0.1

shim-aa64: before 15.8-1.0.1

mokutil: before 15.8-1.0.1

CPE2.3 External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0530


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###