An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3852 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3852-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     June 30, 2024                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : edk2     Version        : 0~20181115.85588389-3+deb10u4     CVE ID         : CVE-2023-48733

    Mate Kukri discovered the Debian build of EDK2, a UEFI firmware     implementation, used an insecure default configuration which could result     in Secure Boot bypass via the UEFI shell.

    For Debian 10 buster, this problem has been fixed in version     0~20181115.85588389-3+deb10u4.

    We recommend that you upgrade your edk2 packages.

    For the detailed security status of edk2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/edk2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5624 advisory.

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer     overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result     in a compromise of confidentiality, integrity, and/or availability. (CVE-2022-36765)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in     DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and     potentially lead to a loss of Confidentiality, Integrity and/or Availability. (CVE-2023-45230)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

  - An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-     resident attacker to bypass Secure Boot. (CVE-2023-48733)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6638-1 advisory.

    Marc Beatove discovered buffer overflows exit in EDK2. An attacker on the local network could potentially     use this to impact availability or possibly cause remote code execution. (CVE-2022-36763, CVE-2022-36764,     CVE-2022-36765)

    It was discovered that a buffer overflows exists in EDK2's Network Package An attacker on the local     network could potentially use these to impact availability or possibly cause remote code execution.
    (CVE-2023-45230, CVE-2023-45234, CVE-2023-45235)

    It was discovered that an out-of-bounds read exists in EDK2's Network Package An attacker on the local     network could potentially use this to impact confidentiality. (CVE-2023-45231)

    It was discovered that infinite-loops exists in EDK2's Network Package An attacker on the local network     could potentially use these to impact availability. (CVE-2023-45232, CVE-2023-45233)

    Mate Kukri discovered that an insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's     EDK2. An attacker could use this to bypass Secure Boot. (CVE-2023-48733)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201169	Debian dla-3852 : ovmf - security update	Nessus	Debian Local Security Checks	medium
190574	Debian dsa-5624 : ovmf - security update	Nessus	Debian Local Security Checks	high
190562	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : EDK II vulnerabilities (USN-6638-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2023-48733

medium

Tenable Plugins

medium

high

high