Critical Flaw in Shim Bootloader Impacts Major Linux Distros
A critical vulnerability in the Shim Linux bootloader has been discovered, allowing attackers to execute code and take control of a target system before the kernel is loaded. This flaw bypasses existing security mechanisms and poses a significant threat to systems using Unified Extensible Firmware Interface (UEFI). Shim, an open-source bootloader maintained by Red Hat, plays a crucial role in the Secure Boot process, ensuring the integrity of the boot process on UEFI systems.
The vulnerability, tracked as CVE-2023-40547, was identified by Microsoft’s security researcher Bill Demirkapi. The bug resides in the httpboot.c source for Shim, which is responsible for booting a network image over HTTP. By manipulating the size parameter in HTTP headers, an attacker can trigger an out-of-bounds write, potentially leading to the execution of privileged code before the operating system loads.
Eclypsium, a security firm, highlighted multiple exploitation paths for CVE-2023-40547, including remote, local, and network adjacent attack vectors. These paths could allow attackers to compromise systems by exploiting the Shim vulnerability.
Impact and Fixes
RedHat released a code commit to address CVE-2023-40547 on December 5, 2023. However, Linux distributions utilizing Shim, such as Red Hat, Debian, Ubuntu, and SUSE, need to apply their patches to mitigate the risk. Users are strongly advised to update to Shim version 15.8, which includes a fix for the vulnerability along with other important security patches.
To further secure systems, Linux users must update the UEFI Secure Boot DBX (revocation list) with the hashes of the vulnerable Shim software and sign the patched version with a valid Microsoft key. This process involves upgrading to Shim 15.8 and applying the DBX update using the ‘fwupdmgr update’ command.
While the likelihood of mass exploitation is low, CVE-2023-40547 should not be disregarded due to the severe consequences of executing code before the OS boot process. It represents a stealthy and potent method for compromising systems.
Conclusion
In conclusion, the critical flaw in the Shim bootloader underscores the importance of timely patching and proactive security measures. By staying informed about vulnerabilities like CVE-2023-40547 and promptly applying patches, users can safeguard their systems against potential threats and maintain the integrity of their operations.
