Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-40547: A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | shim-unsigned-aa64 | 0:12-1.amzn2.0.4 |
| Amazon Linux · 2 | shim-unsigned-aa64-debuginfo | 0:12-1.amzn2.0.4 |
| Amazon Linux · 2 | shim-unsigned-x64 | 0:12-1.amzn2.0.4 |
| Amazon Linux · 2 | shim-unsigned-x64-debuginfo | 0:12-1.amzn2.0.4 |
Vulnerabilities 1
-
High 8.3
Shim: rce in http boot support may lead to secure boot bypass
A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-40547.html