{"id":"CVE-2024-2312","aliases":["BELL-CVE-2024-2312","DEBIAN-CVE-2024-2312","EUVD-2024-27267","GHSA-975v-wj6r-fgj8","SUSE-RU-2026:20004-1","SUSE-RU-2026:20056-1","SUSE-RU-2026:20683-1","SUSE-SU-2026:0741-1","SUSE-SU-2026:0741-2","SUSE-SU-2026:1414-1","UBUNTU-CVE-2024-2312","openSUSE-RU-2026:20325-1"],"status":"published","title":"GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2...","description":"GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00378,"percentile":0.32104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2024-04-05T00:00:00Z","modified":"2026-11-02T12:00:46Z","fixes":[{"ecosystem":"Debian:13","package":"grub2","fixed_in":["2.12-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"grub2","fixed_in":["2.12-2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"shim","fixed_in":["16.1-1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"shim","fixed_in":["16.1-slfo.1.1_1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"shim","fixed_in":["16.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"shim","fixed_in":["16.1-150300.4.31.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"shim","fixed_in":["16.1-25.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"shim","fixed_in":["16.1-25.34.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"grub2-signed","fixed_in":["1.202"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"grub2-unsigned","fixed_in":["2.12-1ubuntu7"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"shim","fixed_in":["16.1-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-slfo.1.1_1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-150300.4.31.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-25.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-25.34.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.00-19ubuntu2","2.00-19ubuntu3","2.00-19ubuntu4","2.00-20","2.00-21","2.00-22","2.02~beta2-5","2.02~beta2-6","2.02~beta2-7","2.02~beta2-8","2.02~beta2-9","2.02~beta2-9ubuntu1","2.02~beta2-9ubuntu1.1","2.02~beta2-9ubuntu1.2","2.02~beta2-9ubuntu1.3","2.02~beta2-9ubuntu1.4","2.02~beta2-9ubuntu1.5","2.02~beta2-9ubuntu1.6","2.02~beta2-9ubuntu1.7","2.02~beta2-9ubuntu1.8","2.02~beta2-9ubuntu1.11","2.02~beta2-9ubuntu1.12","2.02~beta2-9ubuntu1.14","2.02~beta2-9ubuntu1.15","2.02~beta2-9ubuntu1.16","2.02~beta2-9ubuntu1.17","2.02~beta2-9ubuntu1.20","2.02~beta2-9ubuntu1.21"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"grub2-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22","1.23","1.24","1.25","1.26","1.27","1.30","1.31","1.32","1.33","1.34","1.34.1","1.34.2","1.34.3","1.34.4","1.34.5","1.34.6","1.34.7","1.34.8","1.34.9","1.34.13","1.34.14","1.34.16","1.34.17","1.34.18","1.34.20","1.34.22","1.34.24"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"grub2-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.202"}]}],"versions":["1.197","1.199","1.201"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"grub2-unsigned","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-1ubuntu7"}]}],"versions":["2.12~rc1-10ubuntu4","2.12~rc1-12ubuntu2","2.12-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1-160000.1.1"}]}]}],"products":[{"vendor":"debian","product":"debian based gnu grub"},{"vendor":"gnu","product":"grub2"},{"vendor":"netapp","product":"bootstrap_os"}],"references":[{"url":"https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127","tags":["issue-tracking","x_transferred","Exploit","Issue Tracking","Patch","fix"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2312","tags":["issue-tracking","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240426-0003/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2312"},{"url":"https://security.netapp.com/advisory/ntap-20240426-0003"},{"url":"https://github.com/advisories/GHSA-975v-wj6r-fgj8"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-2312","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-2312","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-202620004-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205588","tags":["report"]},{"url":"https://bugzilla.suse.com/1247432","tags":["report"]},{"url":"https://bugzilla.suse.com/1254336","tags":["report"]},{"url":"https://bugzilla.suse.com/1254679","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2312","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-202620056-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-202620683-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260741-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240871","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260741-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261414-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-2312","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2312","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-2312","description":"GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.","status":"published","published":"2024-04-05T19:40:02.848Z","modified":"2025-02-13T17:33:46.314Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:34:09.897248Z"}],"euvd":[{"id":"EUVD-2024-27267","description":"GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.","status":"published","published":"2024-04-05T19:40:02Z","modified":"2025-02-13T17:33:46Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T00:03:47.088299Z"}],"ghsa":[{"id":"GHSA-975v-wj6r-fgj8","title":"GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2...","description":"GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.","status":"published","published":"2024-04-05T21:32:45Z","modified":"2024-08-29T21:31:02Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:58:08.12992Z"}],"nvd":[{"id":"CVE-2024-2312","description":"GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.","status":"published","published":"2024-04-05T20:15:09.02Z","modified":"2026-06-17T07:24:17.663Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:09:48.152273Z"}],"osv":[{"id":"BELL-CVE-2024-2312","title":"CVE-2024-2312 does not affect BellSoft software","status":"withdrawn","published":"2024-04-06T05:58:33.721075Z","modified":"2026-01-26T09:50:12.113812Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-2312","description":"GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.","status":"published","published":"2024-04-05T20:15:09.02Z","modified":"2026-06-17T09:29:30.674093039Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"DEBIAN-CVE-2024-2312","description":"GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.","status":"published","published":"2024-04-05T20:15:09.02Z","modified":"2026-11-02T12:00:46.911200508Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"UBUNTU-CVE-2024-2312","description":"GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.","status":"published","published":"2024-04-05T00:00:00Z","modified":"2025-09-08T16:58:53Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"openSUSE-RU-2026:20325-1","title":"Recommended update for shim","description":"This update for shim fixes the following issues:\n\nThis update for shim fixes the following issues:\n\nshim is updated to version 16.1:\n\n- shim_start_image(): fix guid/handle pairing when uninstalling protocols\n- Fix uncompressed ipv6 netboot\n- fix test segfaults caused by uninitialized memory\n- SbatLevel_Variable.txt: minor typo fix.\n- Realloc() needs to allocate one more byte for sprintf()\n- IPv6: Add more check to avoid multiple double colon and illegal char\n- Loader proto v2\n- loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages\n- Generate Authenticode for the entire PE file\n- README: mention new loader protocol and interaction with UKIs\n- shim: change automatically enable MOK_POLICY_REQUIRE_NX\n- Save var info\n- add SbatLevel entry 2025051000 for PSA-2025-00012-1\n- Coverity fixes 20250804\n- fix http boot\n- Fix double free and leak in the loader protocol\n\n\nshim is updated to version 16.0:\n\n\n- Validate that a supplied vendor cert is not in PEM format\n- sbat: Add grub.peimage,2 to latest (CVE-2024-2312)\n- sbat: Also bump latest for grub,4 (and to todays date)\n- undo change that limits certificate files to a single file\n- shim: don't set second_stage to the empty string\n- Fix SBAT.md for today's consensus about numbers\n- Update Code of Conduct contact address\n- make-certs: Handle missing OpenSSL installation\n- Update MokVars.txt\n- export DEFINES for sub makefile\n- Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition\n- Null-terminate 'arguments' in fallback\n- Fix \"Verifiying\" typo in error message\n- Update Fedora CI targets\n- Force gcc to produce DWARF4 so that gdb can use it\n- Minor housekeeping 2024121700\n- Discard load-options that start with WINDOWS\n- Fix the issue that the gBS-\u003eLoadImage pointer was empty.\n- shim: Allow data after the end of device path node in load options\n- Handle network file not found like disks\n- Update gnu-efi submodule for EFI_HTTP_ERROR\n- Increase EFI file alignment\n- avoid EFIv2 runtime services on Apple x86 machines\n- Improve shortcut performance when comparing two boolean expressions\n- Provide better error message when MokManager is not found\n- tpm: Boot with a warning if the event log is full\n- MokManager: remove redundant logical constraints\n- Test import_mok_state() when MokListRT would be bigger than available size\n- test-mok-mirror: minor bug fix\n- Fix file system browser hang when enrolling MOK from disk\n- Ignore a minor clang-tidy nit\n- Allow fallback to default loader when encountering errors on network boot\n- test.mk: don't use a temporary random.bin\n- pe: Enhance debug report for update_mem_attrs\n- Multiple certificate handling improvements\n- Generate SbatLevel Metadata from SbatLevel_Variable.txt\n- Apply EKU check with compile option\n- Add configuration option to boot an alternative 2nd stage\n- Loader protocol (with Device Path resolution support)\n- netboot cleanup for additional files\n- Document how revocations can be delivered\n- post-process-pe: add tests to validate NX compliance\n- regression: CopyMem() in ad8692e copies out of bounds\n- Save the debug and error logs in mok-variables\n- Add features for the Host Security ID program\n- Mirror some more efi variables to mok-variables\n- This adds DXE Services measurements to HSI and uses them for NX\n- Add shim's current NX_COMPAT status to HSIStatus\n- README.tpm: reflect that vendor_db is in fact logged as \"vendor_db\"\n- Reject HTTP message with duplicate Content-Length header fields\n- Disable log saving\n- fallback: don't add new boot order entries backwards\n- README.tpm: Update MokList entry to MokListRT\n- SBAT Level update for February 2025 GRUB CVEs\n","status":"published","published":"2026-03-05T14:21:04Z","modified":"2026-03-23T04:53:09.961728Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"SUSE-RU-2026:20004-1","title":"Recommended update for shim","description":"This update for shim fixes the following issues:\n\nThis update for shim fixes the following issues:\n\nshim is updated to version 16.1:\n\n- shim_start_image(): fix guid/handle pairing when uninstalling protocols\n- Fix uncompressed ipv6 netboot\n- fix test segfaults caused by uninitialized memory\n- SbatLevel_Variable.txt: minor typo fix.\n- Realloc() needs to allocate one more byte for sprintf()\n- IPv6: Add more check to avoid multiple double colon and illegal char\n- Loader proto v2\n- loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages\n- Generate Authenticode for the entire PE file\n- README: mention new loader protocol and interaction with UKIs\n- shim: change automatically enable MOK_POLICY_REQUIRE_NX\n- Save var info\n- add SbatLevel entry 2025051000 for PSA-2025-00012-1\n- Coverity fixes 20250804\n- fix http boot\n- Fix double free and leak in the loader protocol\n\n\nshim is updated to version 16.0:\n\n\n- Validate that a supplied vendor cert is not in PEM format\n- sbat: Add grub.peimage,2 to latest (CVE-2024-2312)\n- sbat: Also bump latest for grub,4 (and to todays date)\n- undo change that limits certificate files to a single file\n- shim: don't set second_stage to the empty string\n- Fix SBAT.md for today's consensus about numbers\n- Update Code of Conduct contact address\n- make-certs: Handle missing OpenSSL installation\n- Update MokVars.txt\n- export DEFINES for sub makefile\n- Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition\n- Null-terminate 'arguments' in fallback\n- Fix \"Verifiying\" typo in error message\n- Update Fedora CI targets\n- Force gcc to produce DWARF4 so that gdb can use it\n- Minor housekeeping 2024121700\n- Discard load-options that start with WINDOWS\n- Fix the issue that the gBS-\u003eLoadImage pointer was empty.\n- shim: Allow data after the end of device path node in load options\n- Handle network file not found like disks\n- Update gnu-efi submodule for EFI_HTTP_ERROR\n- Increase EFI file alignment\n- avoid EFIv2 runtime services on Apple x86 machines\n- Improve shortcut performance when comparing two boolean expressions\n- Provide better error message when MokManager is not found\n- tpm: Boot with a warning if the event log is full\n- MokManager: remove redundant logical constraints\n- Test import_mok_state() when MokListRT would be bigger than available size\n- test-mok-mirror: minor bug fix\n- Fix file system browser hang when enrolling MOK from disk\n- Ignore a minor clang-tidy nit\n- Allow fallback to default loader when encountering errors on network boot\n- test.mk: don't use a temporary random.bin\n- pe: Enhance debug report for update_mem_attrs\n- Multiple certificate handling improvements\n- Generate SbatLevel Metadata from SbatLevel_Variable.txt\n- Apply EKU check with compile option\n- Add configuration option to boot an alternative 2nd stage\n- Loader protocol (with Device Path resolution support)\n- netboot cleanup for additional files\n- Document how revocations can be delivered\n- post-process-pe: add tests to validate NX compliance\n- regression: CopyMem() in ad8692e copies out of bounds\n- Save the debug and error logs in mok-variables\n- Add features for the Host Security ID program\n- Mirror some more efi variables to mok-variables\n- This adds DXE Services measurements to HSI and uses them for NX\n- Add shim's current NX_COMPAT status to HSIStatus\n- README.tpm: reflect that vendor_db is in fact logged as \"vendor_db\"\n- Reject HTTP message with duplicate Content-Length header fields\n- Disable log saving\n- fallback: don't add new boot order entries backwards\n- README.tpm: Update MokList entry to MokListRT\n- SBAT Level update for February 2025 GRUB CVEs\n\n","status":"published","published":"2025-12-30T16:20:45Z","modified":"2026-03-23T04:48:24.506155Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2026:20056-1","title":"Recommended update for shim","description":"This update for shim fixes the following issues:\n\nThis update for shim fixes the following issues:\n\nshim is updated to version 16.1:\n\n- shim_start_image(): fix guid/handle pairing when uninstalling protocols\n- Fix uncompressed ipv6 netboot\n- fix test segfaults caused by uninitialized memory\n- SbatLevel_Variable.txt: minor typo fix.\n- Realloc() needs to allocate one more byte for sprintf()\n- IPv6: Add more check to avoid multiple double colon and illegal char\n- Loader proto v2\n- loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages\n- Generate Authenticode for the entire PE file\n- README: mention new loader protocol and interaction with UKIs\n- shim: change automatically enable MOK_POLICY_REQUIRE_NX\n- Save var info\n- add SbatLevel entry 2025051000 for PSA-2025-00012-1\n- Coverity fixes 20250804\n- fix http boot\n- Fix double free and leak in the loader protocol\n\n\nshim is updated to version 16.0:\n\n\n- Validate that a supplied vendor cert is not in PEM format\n- sbat: Add grub.peimage,2 to latest (CVE-2024-2312)\n- sbat: Also bump latest for grub,4 (and to todays date)\n- undo change that limits certificate files to a single file\n- shim: don't set second_stage to the empty string\n- Fix SBAT.md for today's consensus about numbers\n- Update Code of Conduct contact address\n- make-certs: Handle missing OpenSSL installation\n- Update MokVars.txt\n- export DEFINES for sub makefile\n- Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition\n- Null-terminate 'arguments' in fallback\n- Fix \"Verifiying\" typo in error message\n- Update Fedora CI targets\n- Force gcc to produce DWARF4 so that gdb can use it\n- Minor housekeeping 2024121700\n- Discard load-options that start with WINDOWS\n- Fix the issue that the gBS-\u003eLoadImage pointer was empty.\n- shim: Allow data after the end of device path node in load options\n- Handle network file not found like disks\n- Update gnu-efi submodule for EFI_HTTP_ERROR\n- Increase EFI file alignment\n- avoid EFIv2 runtime services on Apple x86 machines\n- Improve shortcut performance when comparing two boolean expressions\n- Provide better error message when MokManager is not found\n- tpm: Boot with a warning if the event log is full\n- MokManager: remove redundant logical constraints\n- Test import_mok_state() when MokListRT would be bigger than available size\n- test-mok-mirror: minor bug fix\n- Fix file system browser hang when enrolling MOK from disk\n- Ignore a minor clang-tidy nit\n- Allow fallback to default loader when encountering errors on network boot\n- test.mk: don't use a temporary random.bin\n- pe: Enhance debug report for update_mem_attrs\n- Multiple certificate handling improvements\n- Generate SbatLevel Metadata from SbatLevel_Variable.txt\n- Apply EKU check with compile option\n- Add configuration option to boot an alternative 2nd stage\n- Loader protocol (with Device Path resolution support)\n- netboot cleanup for additional files\n- Document how revocations can be delivered\n- post-process-pe: add tests to validate NX compliance\n- regression: CopyMem() in ad8692e copies out of bounds\n- Save the debug and error logs in mok-variables\n- Add features for the Host Security ID program\n- Mirror some more efi variables to mok-variables\n- This adds DXE Services measurements to HSI and uses them for NX\n- Add shim's current NX_COMPAT status to HSIStatus\n- README.tpm: reflect that vendor_db is in fact logged as \"vendor_db\"\n- Reject HTTP message with duplicate Content-Length header fields\n- Disable log saving\n- fallback: don't add new boot order entries backwards\n- README.tpm: Update MokList entry to MokListRT\n- SBAT Level update for February 2025 GRUB CVEs\n","status":"published","published":"2026-01-01T13:54:36Z","modified":"2026-03-23T04:47:31.913746Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2026:20683-1","title":"Recommended update for shim","description":"This update for shim fixes the following issues:\n\nThis update for shim fixes the following issues:\n\nshim is updated to version 16.1:\n\n- shim_start_image(): fix guid/handle pairing when uninstalling protocols\n- Fix uncompressed ipv6 netboot\n- fix test segfaults caused by uninitialized memory\n- SbatLevel_Variable.txt: minor typo fix.\n- Realloc() needs to allocate one more byte for sprintf()\n- IPv6: Add more check to avoid multiple double colon and illegal char\n- Loader proto v2\n- loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages\n- Generate Authenticode for the entire PE file\n- README: mention new loader protocol and interaction with UKIs\n- shim: change automatically enable MOK_POLICY_REQUIRE_NX\n- Save var info\n- add SbatLevel entry 2025051000 for PSA-2025-00012-1\n- Coverity fixes 20250804\n- fix http boot\n- Fix double free and leak in the loader protocol\n\n\nshim is updated to version 16.0:\n\n\n- Validate that a supplied vendor cert is not in PEM format\n- sbat: Add grub.peimage,2 to latest (CVE-2024-2312)\n- sbat: Also bump latest for grub,4 (and to todays date)\n- undo change that limits certificate files to a single file\n- shim: don't set second_stage to the empty string\n- Fix SBAT.md for today's consensus about numbers\n- Update Code of Conduct contact address\n- make-certs: Handle missing OpenSSL installation\n- Update MokVars.txt\n- export DEFINES for sub makefile\n- Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition\n- Null-terminate 'arguments' in fallback\n- Fix \"Verifiying\" typo in error message\n- Update Fedora CI targets\n- Force gcc to produce DWARF4 so that gdb can use it\n- Minor housekeeping 2024121700\n- Discard load-options that start with WINDOWS\n- Fix the issue that the gBS-\u003eLoadImage pointer was empty.\n- shim: Allow data after the end of device path node in load options\n- Handle network file not found like disks\n- Update gnu-efi submodule for EFI_HTTP_ERROR\n- Increase EFI file alignment\n- avoid EFIv2 runtime services on Apple x86 machines\n- Improve shortcut performance when comparing two boolean expressions\n- Provide better error message when MokManager is not found\n- tpm: Boot with a warning if the event log is full\n- MokManager: remove redundant logical constraints\n- Test import_mok_state() when MokListRT would be bigger than available size\n- test-mok-mirror: minor bug fix\n- Fix file system browser hang when enrolling MOK from disk\n- Ignore a minor clang-tidy nit\n- Allow fallback to default loader when encountering errors on network boot\n- test.mk: don't use a temporary random.bin\n- pe: Enhance debug report for update_mem_attrs\n- Multiple certificate handling improvements\n- Generate SbatLevel Metadata from SbatLevel_Variable.txt\n- Apply EKU check with compile option\n- Add configuration option to boot an alternative 2nd stage\n- Loader protocol (with Device Path resolution support)\n- netboot cleanup for additional files\n- Document how revocations can be delivered\n- post-process-pe: add tests to validate NX compliance\n- regression: CopyMem() in ad8692e copies out of bounds\n- Save the debug and error logs in mok-variables\n- Add features for the Host Security ID program\n- Mirror some more efi variables to mok-variables\n- This adds DXE Services measurements to HSI and uses them for NX\n- Add shim's current NX_COMPAT status to HSIStatus\n- README.tpm: reflect that vendor_db is in fact logged as \"vendor_db\"\n- Reject HTTP message with duplicate Content-Length header fields\n- Disable log saving\n- fallback: don't add new boot order entries backwards\n- README.tpm: Update MokList entry to MokListRT\n- SBAT Level update for February 2025 GRUB CVEs\n","status":"published","published":"2026-03-05T14:21:04Z","modified":"2026-03-23T04:47:32.295843Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2026:0741-1","title":"Security update for shim","description":"\nThis update for shim fixes the following issues:\n\nshim is updated to version 16.1:\n\n- shim_start_image(): fix guid/handle pairing when uninstalling protocols\n- Fix uncompressed ipv6 netboot\n- fix test segfaults caused by uninitialized memory\n- SbatLevel_Variable.txt: minor typo fix.\n- Realloc() needs to allocate one more byte for sprintf()\n- IPv6: Add more check to avoid multiple double colon and illegal char\n- Loader proto v2\n- loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages\n- Generate Authenticode for the entire PE file\n- README: mention new loader protocol and interaction with UKIs\n- shim: change automatically enable MOK_POLICY_REQUIRE_NX\n- Save var info\n- add SbatLevel entry 2025051000 for PSA-2025-00012-1\n- Coverity fixes 20250804\n- fix http boot\n- Fix double free and leak in the loader protocol\n\n\nshim is updated to version 16.0:\n\n\n- Validate that a supplied vendor cert is not in PEM format\n- sbat: Add grub.peimage,2 to latest (CVE-2024-2312)\n- sbat: Also bump latest for grub,4 (and to todays date)\n- undo change that limits certificate files to a single file\n- shim: don't set second_stage to the empty string\n- Fix SBAT.md for today's consensus about numbers\n- Update Code of Conduct contact address\n- make-certs: Handle missing OpenSSL installation\n- Update MokVars.txt\n- export DEFINES for sub makefile\n- Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition\n- Null-terminate 'arguments' in fallback\n- Fix 'Verifiying' typo in error message\n- Update Fedora CI targets\n- Force gcc to produce DWARF4 so that gdb can use it\n- Minor housekeeping 2024121700\n- Discard load-options that start with WINDOWS\n- Fix the issue that the gBS-\u003eLoadImage pointer was empty.\n- shim: Allow data after the end of device path node in load options\n- Handle network file not found like disks\n- Update gnu-efi submodule for EFI_HTTP_ERROR\n- Increase EFI file alignment\n- avoid EFIv2 runtime services on Apple x86 machines\n- Improve shortcut performance when comparing two boolean expressions\n- Provide better error message when MokManager is not found\n- tpm: Boot with a warning if the event log is full\n- MokManager: remove redundant logical constraints\n- Test import_mok_state() when MokListRT would be bigger than available size\n- test-mok-mirror: minor bug fix\n- Fix file system browser hang when enrolling MOK from disk\n- Ignore a minor clang-tidy nit\n- Allow fallback to default loader when encountering errors on network boot\n- test.mk: don't use a temporary random.bin\n- pe: Enhance debug report for update_mem_attrs\n- Multiple certificate handling improvements\n- Generate SbatLevel Metadata from SbatLevel_Variable.txt\n- Apply EKU check with compile option\n- Add configuration option to boot an alternative 2nd stage\n- Loader protocol (with Device Path resolution support)\n- netboot cleanup for additional files\n- Document how revocations can be delivered\n- post-process-pe: add tests to validate NX compliance\n- regression: CopyMem() in ad8692e copies out of bounds\n- Save the debug and error logs in mok-variables\n- Add features for the Host Security ID program\n- Mirror some more efi variables to mok-variables\n- This adds DXE Services measurements to HSI and uses them for NX\n- Add shim's current NX_COMPAT status to HSIStatus\n- README.tpm: reflect that vendor_db is in fact logged as 'vendor_db'\n- Reject HTTP message with duplicate Content-Length header fields\n- Disable log saving\n- fallback: don't add new boot order entries backwards\n- README.tpm: Update MokList entry to MokListRT\n- SBAT Level update for February 2025 GRUB CVEs\n","status":"published","published":"2026-03-02T08:11:15Z","modified":"2026-03-23T04:52:27.831495Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0741-2","title":"Security update for shim","description":"\nThis update for shim fixes the following issues:\n\nshim is updated to version 16.1:\n\n- shim_start_image(): fix guid/handle pairing when uninstalling protocols\n- Fix uncompressed ipv6 netboot\n- fix test segfaults caused by uninitialized memory\n- SbatLevel_Variable.txt: minor typo fix.\n- Realloc() needs to allocate one more byte for sprintf()\n- IPv6: Add more check to avoid multiple double colon and illegal char\n- Loader proto v2\n- loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages\n- Generate Authenticode for the entire PE file\n- README: mention new loader protocol and interaction with UKIs\n- shim: change automatically enable MOK_POLICY_REQUIRE_NX\n- Save var info\n- add SbatLevel entry 2025051000 for PSA-2025-00012-1\n- Coverity fixes 20250804\n- fix http boot\n- Fix double free and leak in the loader protocol\n\n\nshim is updated to version 16.0:\n\n\n- Validate that a supplied vendor cert is not in PEM format\n- sbat: Add grub.peimage,2 to latest (CVE-2024-2312)\n- sbat: Also bump latest for grub,4 (and to todays date)\n- undo change that limits certificate files to a single file\n- shim: don't set second_stage to the empty string\n- Fix SBAT.md for today's consensus about numbers\n- Update Code of Conduct contact address\n- make-certs: Handle missing OpenSSL installation\n- Update MokVars.txt\n- export DEFINES for sub makefile\n- Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition\n- Null-terminate 'arguments' in fallback\n- Fix 'Verifiying' typo in error message\n- Update Fedora CI targets\n- Force gcc to produce DWARF4 so that gdb can use it\n- Minor housekeeping 2024121700\n- Discard load-options that start with WINDOWS\n- Fix the issue that the gBS-\u003eLoadImage pointer was empty.\n- shim: Allow data after the end of device path node in load options\n- Handle network file not found like disks\n- Update gnu-efi submodule for EFI_HTTP_ERROR\n- Increase EFI file alignment\n- avoid EFIv2 runtime services on Apple x86 machines\n- Improve shortcut performance when comparing two boolean expressions\n- Provide better error message when MokManager is not found\n- tpm: Boot with a warning if the event log is full\n- MokManager: remove redundant logical constraints\n- Test import_mok_state() when MokListRT would be bigger than available size\n- test-mok-mirror: minor bug fix\n- Fix file system browser hang when enrolling MOK from disk\n- Ignore a minor clang-tidy nit\n- Allow fallback to default loader when encountering errors on network boot\n- test.mk: don't use a temporary random.bin\n- pe: Enhance debug report for update_mem_attrs\n- Multiple certificate handling improvements\n- Generate SbatLevel Metadata from SbatLevel_Variable.txt\n- Apply EKU check with compile option\n- Add configuration option to boot an alternative 2nd stage\n- Loader protocol (with Device Path resolution support)\n- netboot cleanup for additional files\n- Document how revocations can be delivered\n- post-process-pe: add tests to validate NX compliance\n- regression: CopyMem() in ad8692e copies out of bounds\n- Save the debug and error logs in mok-variables\n- Add features for the Host Security ID program\n- Mirror some more efi variables to mok-variables\n- This adds DXE Services measurements to HSI and uses them for NX\n- Add shim's current NX_COMPAT status to HSIStatus\n- README.tpm: reflect that vendor_db is in fact logged as 'vendor_db'\n- Reject HTTP message with duplicate Content-Length header fields\n- Disable log saving\n- fallback: don't add new boot order entries backwards\n- README.tpm: Update MokList entry to MokListRT\n- SBAT Level update for February 2025 GRUB CVEs\n","status":"published","published":"2026-06-16T14:41:50Z","modified":"2026-06-17T09:15:06.674103721Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1414-1","title":"Security update for shim","description":"\nThis update for shim fixes the following issues:\n\nshim is updated to version 16.1:\n\n- shim_start_image(): fix guid/handle pairing when uninstalling protocols\n- Fix uncompressed ipv6 netboot\n- fix test segfaults caused by uninitialized memory\n- SbatLevel_Variable.txt: minor typo fix.\n- Realloc() needs to allocate one more byte for sprintf()\n- IPv6: Add more check to avoid multiple double colon and illegal char\n- Loader proto v2\n- loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages\n- Generate Authenticode for the entire PE file\n- README: mention new loader protocol and interaction with UKIs\n- shim: change automatically enable MOK_POLICY_REQUIRE_NX\n- Save var info\n- add SbatLevel entry 2025051000 for PSA-2025-00012-1\n- Coverity fixes 20250804\n- fix http boot\n- Fix double free and leak in the loader protocol\n\n\nshim is updated to version 16.0:\n\n\n- Validate that a supplied vendor cert is not in PEM format\n- sbat: Add grub.peimage,2 to latest (CVE-2024-2312)\n- sbat: Also bump latest for grub,4 (and to todays date)\n- undo change that limits certificate files to a single file\n- shim: don't set second_stage to the empty string\n- Fix SBAT.md for today's consensus about numbers\n- Update Code of Conduct contact address\n- make-certs: Handle missing OpenSSL installation\n- Update MokVars.txt\n- export DEFINES for sub makefile\n- Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition\n- Null-terminate 'arguments' in fallback\n- Fix 'Verifiying' typo in error message\n- Update Fedora CI targets\n- Force gcc to produce DWARF4 so that gdb can use it\n- Minor housekeeping 2024121700\n- Discard load-options that start with WINDOWS\n- Fix the issue that the gBS-\u003eLoadImage pointer was empty.\n- shim: Allow data after the end of device path node in load options\n- Handle network file not found like disks\n- Update gnu-efi submodule for EFI_HTTP_ERROR\n- Increase EFI file alignment\n- avoid EFIv2 runtime services on Apple x86 machines\n- Improve shortcut performance when comparing two boolean expressions\n- Provide better error message when MokManager is not found\n- tpm: Boot with a warning if the event log is full\n- MokManager: remove redundant logical constraints\n- Test import_mok_state() when MokListRT would be bigger than available size\n- test-mok-mirror: minor bug fix\n- Fix file system browser hang when enrolling MOK from disk\n- Ignore a minor clang-tidy nit\n- Allow fallback to default loader when encountering errors on network boot\n- test.mk: don't use a temporary random.bin\n- pe: Enhance debug report for update_mem_attrs\n- Multiple certificate handling improvements\n- Generate SbatLevel Metadata from SbatLevel_Variable.txt\n- Apply EKU check with compile option\n- Add configuration option to boot an alternative 2nd stage\n- Loader protocol (with Device Path resolution support)\n- netboot cleanup for additional files\n- Document how revocations can be delivered\n- post-process-pe: add tests to validate NX compliance\n- regression: CopyMem() in ad8692e copies out of bounds\n- Save the debug and error logs in mok-variables\n- Add features for the Host Security ID program\n- Mirror some more efi variables to mok-variables\n- This adds DXE Services measurements to HSI and uses them for NX\n- Add shim's current NX_COMPAT status to HSIStatus\n- README.tpm: reflect that vendor_db is in fact logged as 'vendor_db'\n- Reject HTTP message with duplicate Content-Length header fields\n- Disable log saving\n- fallback: don't add new boot order entries backwards\n- README.tpm: Update MokList entry to MokListRT\n- SBAT Level update for February 2025 GRUB CVEs\n","status":"published","published":"2026-04-16T14:25:27Z","modified":"2026-04-17T09:01:13.230276Z","updated_at":"2026-11-02T15:54:01.262144Z"}]}}