Bugzilla – Bug 1215102
VUL-0: CVE-2023-40550: shim: pe: Fix an out-of-bound read in verify_buffer_sbat()
Last modified: 2024-07-12 09:30:14 UTC
CRD: 2023-12-12
Created attachment 871410 [details] shim commit CVE-2023-40550 from keybase
Created attachment 871509 [details] CVE-2023-40550 from keybase
Created attachment 871512 [details] CVE-2023-40550-2 codes from keybase
embargo end was shifted again: CRD: 2024-01-23
is public https://github.com/rhboot/shim/releases/tag/15.8
shim-15.8 update has been submitted to Factory for reviewing. Please refer https://build.opensuse.org/request/show/1142576
SUSE-SU-2024:1368-1: An update that solves seven vulnerabilities, contains one feature and has five security fixes can now be installed. Category: security (important) Bug References: 1198101, 1205588, 1205855, 1210382, 1213945, 1215098, 1215099, 1215100, 1215101, 1215102, 1215103, 1219460 CVE References: CVE-2022-28737, CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551 Jira References: PED-922 Maintenance Incident: [SUSE:Maintenance:32617](https://smelt.suse.de/incident/32617/) Sources used: openSUSE Leap 15.3 (src): shim-15.8-150300.4.20.2, efitools-1.9.2-150300.7.3.1 openSUSE Leap Micro 5.3 (src): shim-15.8-150300.4.20.2 openSUSE Leap Micro 5.4 (src): shim-15.8-150300.4.20.2 openSUSE Leap 15.5 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro for Rancher 5.3 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro 5.3 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro for Rancher 5.4 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro 5.4 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro 5.5 (src): shim-15.8-150300.4.20.2 Basesystem Module 15-SP5 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): shim-15.8-150300.4.20.2 SUSE Manager Proxy 4.3 (src): shim-15.8-150300.4.20.2 SUSE Manager Retail Branch Server 4.3 (src): shim-15.8-150300.4.20.2 SUSE Manager Server 4.3 (src): shim-15.8-150300.4.20.2 SUSE Enterprise Storage 7.1 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro 5.1 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro 5.2 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro for Rancher 5.2 (src): shim-15.8-150300.4.20.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1462-1: An update that solves seven vulnerabilities, contains one feature and has five security fixes can now be installed. Category: security (important) Bug References: 1198101, 1205588, 1205855, 1210382, 1213945, 1215098, 1215099, 1215100, 1215101, 1215102, 1215103, 1219460 CVE References: CVE-2022-28737, CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551 Jira References: PED-922 Maintenance Incident: [SUSE:Maintenance:33581](https://smelt.suse.de/incident/33581/) Sources used: SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): shim-15.8-25.30.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): shim-15.8-25.30.1 SUSE Linux Enterprise Server 12 SP5 (src): shim-15.8-25.30.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1461-1: An update that solves seven vulnerabilities, contains one feature and has five security fixes can now be installed. Category: security (important) Bug References: 1198101, 1205588, 1205855, 1210382, 1213945, 1215098, 1215099, 1215100, 1215101, 1215102, 1215103, 1219460 CVE References: CVE-2022-28737, CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551 Jira References: PED-922 Maintenance Incident: [SUSE:Maintenance:33579](https://smelt.suse.de/incident/33579/) Sources used: SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): shim-15.8-150100.3.38.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): shim-15.8-150100.3.38.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): shim-15.8-150100.3.38.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.