Detections
Analytics
RHEL 8 : shim and fwupd (RHSA-2021:3675)
high Nessus Plugin ID 153777
Language:
Synopsis
The remote Red Hat host is missing one or more security updates for shim / fwupd.Description
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3675 advisory.The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.
The fwupd packages provide a service that allows session software to update device firmware.
The following packages have been upgraded to a later upstream version: shim (15.4). (BZ#1932410)
Security Fix(es):
* grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled (CVE-2020-14372)
* grub2: Use-after-free in rmmod command (CVE-2020-25632)
* grub2: Out-of-bounds write in grub_usb_device_initialize() (CVE-2020-25647)
* grub2: Stack buffer overflow in grub_parser_split_cmdline() (CVE-2020-27749)
* grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled (CVE-2020-27779)
* grub2: Heap out-of-bounds write in short form option parser (CVE-2021-20225)
* grub2: Heap out-of-bounds write due to miscalculation of space required for quoting (CVE-2021-20233)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the RHEL shim / fwupd packages based on the guidance in RHSA-2021:3675.See Also
http://www.nessus.org/u?7ff17196
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/security/vulnerabilities/RHSB-2021-003
https://access.redhat.com/errata/RHSA-2021:3675
https://bugzilla.redhat.com/show_bug.cgi?id=1873150
https://bugzilla.redhat.com/show_bug.cgi?id=1879577
https://bugzilla.redhat.com/show_bug.cgi?id=1886936
https://bugzilla.redhat.com/show_bug.cgi?id=1899966
https://bugzilla.redhat.com/show_bug.cgi?id=1900698
Plugin Details
Severity: High
ID: 153777
File Name: redhat-RHSA-2021-3675.nasl
Version: 1.9
Type: local
Agent: unix
Family: Red Hat Local Security Checks
Published: 9/28/2021
Updated: 11/7/2024
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.3
Vendor
Vendor Severity: Moderate
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2021-20233
CVSS v3
Risk Factor: High
Base Score: 8.2
Temporal Score: 7.4
Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:redhat:enterprise_linux:shim-x64, p-cpe:/a:redhat:enterprise_linux:fwupd, p-cpe:/a:redhat:enterprise_linux:shim, p-cpe:/a:redhat:enterprise_linux:shim-unsigned-aarch64, p-cpe:/a:redhat:enterprise_linux:shim-unsigned-x64, cpe:/o:redhat:rhel_eus:8.1, p-cpe:/a:redhat:enterprise_linux:shim-ia32, p-cpe:/a:redhat:enterprise_linux:shim-aa64
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/28/2021
Vulnerability Publication Date: 7/30/2020
Reference Information
CVE: CVE-2020-14372, CVE-2020-25632, CVE-2020-25647, CVE-2020-27749, CVE-2020-27779, CVE-2021-20225, CVE-2021-20233