CVE-2022-28737

There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.

There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.

There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.

There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.

Initial UEFI bootloader that handles chaining to a trusted full bootloader under secure boot environments.

Security Fix(es):

No description is available for this CVE.(CVE-2022-28737)

The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.

The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.

Security Fix(es):

• grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)

• grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)

• grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)

• grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)

• grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)

• grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)

• grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)

• shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.

The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.

Security Fix(es):

• grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)

• grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)

• grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)

• grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)

• grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)

• grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)

• grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)

• shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.

The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments. Security Fix(es):

• grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)
• grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)
• grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)
• grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)
• grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)
• grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)
• grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)
• shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments. Security Fix(es):

• grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)
• grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)
• grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)
• grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)
• grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)
• grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)
• grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)
• shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for shim fixes the following issues:

• Updated shim signature after shim 15.7 be signed back: signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458)

• Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe because grub2 is not ready. (bsc#1205588)

• Enable the NX compatibility flag by default. (jsc#PED-127)

Update to 15.7 (bsc#1198458) (jsc#PED-127):

• Make SBAT variable payload introspectable
• Reference MokListRT instead of MokList
• Add a link to the test plan in the readme.
• [V3] Enable TDX measurement to RTMR register
• Discard load-options that start with a NUL
• Fixed load_cert_file bugs
• Add -malign-double to IA32 compiler flags
• pe: Fix image section entry-point validation
• make-archive: Build reproducible tarball
• mok: remove MokListTrusted from PCR 7

Other fixes:

• Support enhance shim measurement to TD RTMR. (jsc#PED-1273)

• shim-install: ensure grub.cfg created is not overwritten after installing grub related files

• Add logic to shim.spec to only set sbat policy when efivarfs is writeable. (bsc#1201066)

• Add logic to shim.spec for detecting --set-sbat-policy option before using mokutil to set sbat policy. (bsc#1202120)

• Change the URL in SBAT section to mail:[email protected]. (bsc#1193282)

Update to 15.6 (bsc#1198458):

• MokManager: removed Locate graphic output protocol fail error message
• shim: implement SBAT verification for the shim_lock protocol
• post-process-pe: Fix a missing return code check
• Update github actions matrix to be more useful
• post-process-pe: Fix format string warnings on 32-bit platforms
• Allow MokListTrusted to be enabled by default
• Re-add ARM AArch64 support
• Use ASCII as fallback if Unicode Box Drawing characters fail
• make: don't treat cert.S specially
• shim: use SHIM_DEVEL_VERBOSE when built in devel mode
• Break out of the inner sbat loop if we find the entry.
• Support loading additional certificates
• Add support for NX (W^X) mitigations.
• Fix preserve_sbat_uefi_variable() logic
• SBAT Policy latest should be a one-shot
• pe: Fix a buffer overflow when SizeOfRawData > VirtualSize
• pe: Perform image verification earlier when loading grub
• Update advertised sbat generation number for shim
• Update SBAT generation requirements for 05/24/22
• Also avoid CVE-2022-28737 in verify_image() by @vathpela

Update to 15.5 (bsc#1198458):

• Broken ia32 relocs and an unimportant submodule change.
• mok: allocate MOK config table as BootServicesData
• Don't call QueryVariableInfo() on EFI 1.10 machines (bsc#1187260)
• Relax the check for import_mok_state() (bsc#1185261)
• SBAT.md: trivial changes
• shim: another attempt to fix load options handling
• Add tests for our load options parsing.
• arm/aa64: fix the size of .rela* sections
• mok: fix potential buffer overrun in import_mok_state
• mok: relax the maximum variable size check
• Don't unhook ExitBootServices when EBS protection is disabled
• fallback: find_boot_option() needs to return the index for the boot entry in optnum
• httpboot: Ignore case when checking HTTP headers
• Fallback allocation errors
• shim: avoid BOOTx64.EFI in message on other architectures
• str: remove duplicate parameter check
• fallback: add compile option FALLBACK_NONINTERACTIVE
• Test mok mirror
• Modify sbat.md to help with readability.
• csv: detect end of csv file correctly
• Specify that the .sbat section is ASCII not UTF-8
• tests: add 'include-fixed' GCC directory to include directories
• pe: simplify generate_hash()
• Don't make shim abort when TPM log event fails (RHBZ #2002265)
• Fallback to default loader if parsed one does not exist
• fallback: Fix for BootOrder crash when index returned
• Better console checks
• docs: update SBAT UEFI variable name
• Don't parse load options if invoked from removable media path
• fallback: fix fallback not passing arguments of the first boot option
• shim: Don't stop forever at 'Secure…

This update for shim fixes the following issues:

• Updated shim signature after shim 15.7 be signed back: signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458)

• Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe because grub2 is not ready. (bsc#1205588)

• Enable the NX compatibility flag by default. (jsc#PED-127)

Update to 15.7 (bsc#1198458) (jsc#PED-127):

• Make SBAT variable payload introspectable
• Reference MokListRT instead of MokList
• Add a link to the test plan in the readme.
• [V3] Enable TDX measurement to RTMR register
• Discard load-options that start with a NUL
• Fixed load_cert_file bugs
• Add -malign-double to IA32 compiler flags
• pe: Fix image section entry-point validation
• make-archive: Build reproducible tarball
• mok: remove MokListTrusted from PCR 7

Other fixes:

• Support enhance shim measurement to TD RTMR. (jsc#PED-1273)

• shim-install: ensure grub.cfg created is not overwritten after installing grub related files

• Add logic to shim.spec to only set sbat policy when efivarfs is writeable. (bsc#1201066)

• Add logic to shim.spec for detecting --set-sbat-policy option before using mokutil to set sbat policy. (bsc#1202120)

• Change the URL in SBAT section to mail:[email protected]. (bsc#1193282)

Update to 15.6 (bsc#1198458):

• MokManager: removed Locate graphic output protocol fail error message
• shim: implement SBAT verification for the shim_lock protocol
• post-process-pe: Fix a missing return code check
• Update github actions matrix to be more useful
• post-process-pe: Fix format string warnings on 32-bit platforms
• Allow MokListTrusted to be enabled by default
• Re-add ARM AArch64 support
• Use ASCII as fallback if Unicode Box Drawing characters fail
• make: don't treat cert.S specially
• shim: use SHIM_DEVEL_VERBOSE when built in devel mode
• Break out of the inner sbat loop if we find the entry.
• Support loading additional certificates
• Add support for NX (W^X) mitigations.
• Fix preserve_sbat_uefi_variable() logic
• SBAT Policy latest should be a one-shot
• pe: Fix a buffer overflow when SizeOfRawData > VirtualSize
• pe: Perform image verification earlier when loading grub
• Update advertised sbat generation number for shim
• Update SBAT generation requirements for 05/24/22
• Also avoid CVE-2022-28737 in verify_image() by @vathpela

Update to 15.5 (bsc#1198458):

• Broken ia32 relocs and an unimportant submodule change.
• mok: allocate MOK config table as BootServicesData
• Don't call QueryVariableInfo() on EFI 1.10 machines (bsc#1187260)
• Relax the check for import_mok_state() (bsc#1185261)
• SBAT.md: trivial changes
• shim: another attempt to fix load options handling
• Add tests for our load options parsing.
• arm/aa64: fix the size of .rela* sections
• mok: fix potential buffer overrun in import_mok_state
• mok: relax the maximum variable size check
• Don't unhook ExitBootServices when EBS protection is disabled
• fallback: find_boot_option() needs to return the index for the boot entry in optnum
• httpboot: Ignore case when checking HTTP headers
• Fallback allocation errors
• shim: avoid BOOTx64.EFI in message on other architectures
• str: remove duplicate parameter check
• fallback: add compile option FALLBACK_NONINTERACTIVE
• Test mok mirror
• Modify sbat.md to help with readability.
• csv: detect end of csv file correctly
• Specify that the .sbat section is ASCII not UTF-8
• tests: add 'include-fixed' GCC directory to include directories
• pe: simplify generate_hash()
• Don't make shim abort when TPM log event fails (RHBZ #2002265)
• Fallback to default loader if parsed one does not exist
• fallback: Fix for BootOrder crash when index returned
• Better console checks
• docs: update SBAT UEFI variable name
• Don't parse load options if invoked from removable media path
• fallback: fix fallback not passing arguments of the first boot option
• shim: Don't stop forever at 'Secure…

This update for shim fixes the following issues:

• CVE-2022-28737 was missing as reference previously.

• Upgrade shim-install for bsc#1210382

  After closing Leap-gap project since Leap 15.3, openSUSE Leap direct uses shim from SLE. So the ca_string is 'SUSE Linux Enterprise Secure Boot CA1', not 'openSUSE Secure Boot CA1'. It causes that the update_boot=no, so all files in /boot/efi/EFI/boot are not updated.

  Logic was added that is using ID field in os-release for checking Leap distro and set ca_string to 'SUSE Linux Enterprise Secure Boot CA1'. Then /boot/efi/EFI/boot/* can also be updated.

This update for shim fixes the following issues:

• Updated shim signature after shim 15.7 be signed back: signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458)

• Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe because grub2 is not ready. (bsc#1205588)

• Enable the NX compatibility flag by default. (jsc#PED-127)

Update to 15.7 (bsc#1198458) (jsc#PED-127):

• Make SBAT variable payload introspectable
• Reference MokListRT instead of MokList
• Add a link to the test plan in the readme.
• [V3] Enable TDX measurement to RTMR register
• Discard load-options that start with a NUL
• Fixed load_cert_file bugs
• Add -malign-double to IA32 compiler flags
• pe: Fix image section entry-point validation
• make-archive: Build reproducible tarball
• mok: remove MokListTrusted from PCR 7

Other fixes:

• Support enhance shim measurement to TD RTMR. (jsc#PED-1273)

• shim-install: ensure grub.cfg created is not overwritten after installing grub related files

• Add logic to shim.spec to only set sbat policy when efivarfs is writeable. (bsc#1201066)

• Add logic to shim.spec for detecting --set-sbat-policy option before using mokutil to set sbat policy. (bsc#1202120)

• Change the URL in SBAT section to mail:[email protected]. (bsc#1193282)

Update to 15.6 (bsc#1198458):

• MokManager: removed Locate graphic output protocol fail error message
• shim: implement SBAT verification for the shim_lock protocol
• post-process-pe: Fix a missing return code check
• Update github actions matrix to be more useful
• post-process-pe: Fix format string warnings on 32-bit platforms
• Allow MokListTrusted to be enabled by default
• Re-add ARM AArch64 support
• Use ASCII as fallback if Unicode Box Drawing characters fail
• make: don't treat cert.S specially
• shim: use SHIM_DEVEL_VERBOSE when built in devel mode
• Break out of the inner sbat loop if we find the entry.
• Support loading additional certificates
• Add support for NX (W^X) mitigations.
• Fix preserve_sbat_uefi_variable() logic
• SBAT Policy latest should be a one-shot
• pe: Fix a buffer overflow when SizeOfRawData > VirtualSize
• pe: Perform image verification earlier when loading grub
• Update advertised sbat generation number for shim
• Update SBAT generation requirements for 05/24/22
• Also avoid CVE-2022-28737 in verify_image() by @vathpela

Update to 15.5 (bsc#1198458):

• Broken ia32 relocs and an unimportant submodule change.
• mok: allocate MOK config table as BootServicesData
• Don't call QueryVariableInfo() on EFI 1.10 machines (bsc#1187260)
• Relax the check for import_mok_state() (bsc#1185261)
• SBAT.md: trivial changes
• shim: another attempt to fix load options handling
• Add tests for our load options parsing.
• arm/aa64: fix the size of .rela* sections
• mok: fix potential buffer overrun in import_mok_state
• mok: relax the maximum variable size check
• Don't unhook ExitBootServices when EBS protection is disabled
• fallback: find_boot_option() needs to return the index for the boot entry in optnum
• httpboot: Ignore case when checking HTTP headers
• Fallback allocation errors
• shim: avoid BOOTx64.EFI in message on other architectures
• str: remove duplicate parameter check
• fallback: add compile option FALLBACK_NONINTERACTIVE
• Test mok mirror
• Modify sbat.md to help with readability.
• csv: detect end of csv file correctly
• Specify that the .sbat section is ASCII not UTF-8
• tests: add 'include-fixed' GCC directory to include directories
• pe: simplify generate_hash()
• Don't make shim abort when TPM log event fails (RHBZ #2002265)
• Fallback to default loader if parsed one does not exist
• fallback: Fix for BootOrder crash when index returned
• Better console checks
• docs: update SBAT UEFI variable name
• Don't parse load options if invoked from removable media path
• fallback: fix fallback not passing arguments of the first boot option
• shim: Don't stop forever at 'Secure…

This update for shim fixes the following issues:

• Update only adds the CVE reference to the previously released update (bsc#1198458, CVE-2022-28737)

This update for shim fixes the following issues:

• Updated shim signature after shim 15.7 be signed back: signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458)

• Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe because grub2 is not ready. (bsc#1205588)

• Enable the NX compatibility flag by default. (jsc#PED-127)

Update to 15.7 (bsc#1198458) (jsc#PED-127):

• Make SBAT variable payload introspectable
• Reference MokListRT instead of MokList
• Add a link to the test plan in the readme.
• [V3] Enable TDX measurement to RTMR register
• Discard load-options that start with a NUL
• Fixed load_cert_file bugs
• Add -malign-double to IA32 compiler flags
• pe: Fix image section entry-point validation
• make-archive: Build reproducible tarball
• mok: remove MokListTrusted from PCR 7

Other fixes:

• Support enhance shim measurement to TD RTMR. (jsc#PED-1273)

• shim-install: ensure grub.cfg created is not overwritten after installing grub related files

• Add logic to shim.spec to only set sbat policy when efivarfs is writeable. (bsc#1201066)

• Add logic to shim.spec for detecting --set-sbat-policy option before using mokutil to set sbat policy. (bsc#1202120)

• Change the URL in SBAT section to mail:[email protected]. (bsc#1193282)

Update to 15.6 (bsc#1198458):

• MokManager: removed Locate graphic output protocol fail error message
• shim: implement SBAT verification for the shim_lock protocol
• post-process-pe: Fix a missing return code check
• Update github actions matrix to be more useful
• post-process-pe: Fix format string warnings on 32-bit platforms
• Allow MokListTrusted to be enabled by default
• Re-add ARM AArch64 support
• Use ASCII as fallback if Unicode Box Drawing characters fail
• make: don't treat cert.S specially
• shim: use SHIM_DEVEL_VERBOSE when built in devel mode
• Break out of the inner sbat loop if we find the entry.
• Support loading additional certificates
• Add support for NX (W^X) mitigations.
• Fix preserve_sbat_uefi_variable() logic
• SBAT Policy latest should be a one-shot
• pe: Fix a buffer overflow when SizeOfRawData > VirtualSize
• pe: Perform image verification earlier when loading grub
• Update advertised sbat generation number for shim
• Update SBAT generation requirements for 05/24/22
• Also avoid CVE-2022-28737 in verify_image() by @vathpela

Update to 15.5 (bsc#1198458):

• Broken ia32 relocs and an unimportant submodule change.
• mok: allocate MOK config table as BootServicesData
• Don't call QueryVariableInfo() on EFI 1.10 machines (bsc#1187260)
• Relax the check for import_mok_state() (bsc#1185261)
• SBAT.md: trivial changes
• shim: another attempt to fix load options handling
• Add tests for our load options parsing.
• arm/aa64: fix the size of .rela* sections
• mok: fix potential buffer overrun in import_mok_state
• mok: relax the maximum variable size check
• Don't unhook ExitBootServices when EBS protection is disabled
• fallback: find_boot_option() needs to return the index for the boot entry in optnum
• httpboot: Ignore case when checking HTTP headers
• Fallback allocation errors
• shim: avoid BOOTx64.EFI in message on other architectures
• str: remove duplicate parameter check
• fallback: add compile option FALLBACK_NONINTERACTIVE
• Test mok mirror
• Modify sbat.md to help with readability.
• csv: detect end of csv file correctly
• Specify that the .sbat section is ASCII not UTF-8
• tests: add 'include-fixed' GCC directory to include directories
• pe: simplify generate_hash()
• Don't make shim abort when TPM log event fails (RHBZ #2002265)
• Fallback to default loader if parsed one does not exist
• fallback: Fix for BootOrder crash when index returned
• Better console checks
• docs: update SBAT UEFI variable name
• Don't parse load options if invoked from removable media path
• fallback: fix fallback not passing arguments of the first boot option
• shim: Don't stop forever at 'Secure…

This update for shim fixes the following issues:

• Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)
• Limit the requirement of fde-tpm-helper-macros to the distro with suse_version 1600 and above (bsc#1219460)

Update to version 15.8:

Security issues fixed:

• mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)
• avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)
• Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)
• Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)
• pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)
• pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)

The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now.

• Generate dbx during build so we don't include binary files in sources

• Don't require grub so shim can still be used with systemd-boot

• Update shim-install to fix boot failure of ext4 root file system on RAID10 (bsc#1205855)

• Adopt the macros from fde-tpm-helper-macros to update the signature in the sealed key after a bootloader upgrade

• Update shim-install to amend full disk encryption support

  • Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector
  • Use the long name to specify the grub2 key protector
  • cryptodisk: support TPM authorized policies
  • Do not use tpm_record_pcrs unless the command is in command.lst

• Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to enable the NX compatibility flag when using post-process-pe after discussed with grub2 experts in mail. It's useful for further development and testing. (bsc#1205588)

This update for shim fixes the following issues:

• Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)
• Limit the requirement of fde-tpm-helper-macros to the distro with suse_version 1600 and above (bsc#1219460)

Update to version 15.8:

Security issues fixed:

• mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)
• avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)
• Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)
• Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)
• pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)
• pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)

The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now.

• Generate dbx during build so we don't include binary files in sources

• Don't require grub so shim can still be used with systemd-boot

• Update shim-install to fix boot failure of ext4 root file system on RAID10 (bsc#1205855)

• Adopt the macros from fde-tpm-helper-macros to update the signature in the sealed key after a bootloader upgrade

• Update shim-install to amend full disk encryption support

  • Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector
  • Use the long name to specify the grub2 key protector
  • cryptodisk: support TPM authorized policies
  • Do not use tpm_record_pcrs unless the command is in command.lst

• Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to enable the NX compatibility flag when using post-process-pe after discussed with grub2 experts in mail. It's useful for further development and testing. (bsc#1205588)

This update for shim fixes the following issues:

• Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)
• Limit the requirement of fde-tpm-helper-macros to the distro with suse_version 1600 and above (bsc#1219460)

Update to version 15.8:

Security issues fixed:

• mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)
• avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)
• Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)
• Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)
• pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)
• pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)

The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now.

• Generate dbx during build so we don't include binary files in sources

• Don't require grub so shim can still be used with systemd-boot

• Update shim-install to fix boot failure of ext4 root file system on RAID10 (bsc#1205855)

• Adopt the macros from fde-tpm-helper-macros to update the signature in the sealed key after a bootloader upgrade

• Update shim-install to amend full disk encryption support

  • Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector
  • Use the long name to specify the grub2 key protector
  • cryptodisk: support TPM authorized policies
  • Do not use tpm_record_pcrs unless the command is in command.lst

• Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to enable the NX compatibility flag when using post-process-pe after discussed with grub2 experts in mail. It's useful for further development and testing. (bsc#1205588)

Daniel Axtens discovered that specially crafted images could cause a heap-based out-of-bonds write. A local attacker could possibly use this to circumvent secure boot protections. (CVE-2021-3695)

Daniel Axtens discovered that specially crafted images could cause out-of-bonds read and write. A local attacker could possibly use this to circumvent secure boot protections. (CVE-2021-3696)

Daniel Axtens discovered that specially crafted images could cause buffer underwrite which allows arbitrary data to be written to a heap. A local attacker could possibly use this to circumvent secure boot protections. (CVE-2021-3697)

It was discovered that GRUB2 configuration files were created with the wrong permissions. An attacker could possibly use this to leak encrypted passwords. (CVE-2021-3981)

Daniel Axtens discovered that specially crafted IP packets could cause an integer underflow and write past the end of a buffer. An attacker could possibly use this to circumvent secure boot protections. (CVE-2022-28733)

Daniel Axtens discovered that specially crafted HTTP headers can cause an out-of-bounds write of a NULL byte. An attacker could possibly use this to corrupt GRUB2's internal data. (CVE-2022-28734)

Julian Andres Klode discovered that GRUB2 shim_lock allowed non- kernel files to be loaded. A local attack could possibly use this to circumvent secure boot protections. (CVE-2022-28735)

Chris Coulson discovered that executing chainloaders more than once caused a use-after-free vulnerability. A local attack could possibly use this to circumvent secure boot protections. (CVE-2022-28736)

Chris Coulson discovered that specially crafted executables could cause shim to make out-of-bound writes. A local attack could possibly use this to circumvent secure boot protections. (CVE-2022-28737)

Zhang Boyang discovered that specially crafted unicode sequences could lead to an out-of-bounds write to a heap. A local attacker could possibly use this to circumvent secure boot protections. (CVE-2022-3775)