Описание
A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.
Отчет
Red-hat rates this vulnerability as Moderate impact. The vulnerability does not guarantee all times the library is used the same behavior, but it could make the system unstable, allow local denial of service or corrupt both integrity and availability of the system.
Меры по смягчению последствий
The code could be modified to include NULL pointer checkers in the code. Before DevicePathToStr : "if (li == NULL || li->FilePath == NULL) return 0;" After DevicePathToStr : "if (bootpath == NULL) return 0;" At error: "if (bootpath != NULL)"
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 7 | shim-signed | Fix deferred | ||
| Red Hat Enterprise Linux 8 | shim-unsigned-aarch64 | Fix deferred | ||
| Red Hat Enterprise Linux 9 | shim-unsigned-aarch64 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
3.9 Low
CVSS3
Связанные уязвимости
A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.
A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.
A NULL pointer vulnerability has been found in the the shim applicatio ...
A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.
EPSS
3.9 Low
CVSS3