The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1368-1 advisory.

  - There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables;
    The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An     attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not     discarded in such scenario. (CVE-2022-28737)

  - A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create     the new variable, it tries to print an error message to the user; however, the number of parameters used     by the logging function doesn't match the format string used by it, leading to a crash under certain     circumstances. (CVE-2023-40546)

  - A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled     values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP     request, leading to a completely controlled out-of-bounds write primitive and complete system compromise.
    This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-     Middle or compromise the boot server to be able to exploit this vulnerability successfully.
    (CVE-2023-40547)

  - A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition     operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is     further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes     memory corruption and can lead to a crash or data integrity issues during the boot phase. (CVE-2023-40548)

  - An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the     load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and     crashing Shim, resulting in a denial of service. (CVE-2023-40549)

  - An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue     may expose sensitive data during the system's boot phase. (CVE-2023-40550)

  - A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or     possible exposure of sensitive data during the system's boot phase. (CVE-2023-40551)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1461-1 advisory.

  - There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables;
    The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An     attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not     discarded in such scenario. (CVE-2022-28737)

  - A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create     the new variable, it tries to print an error message to the user; however, the number of parameters used     by the logging function doesn't match the format string used by it, leading to a crash under certain     circumstances. (CVE-2023-40546)

  - A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled     values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP     request, leading to a completely controlled out-of-bounds write primitive and complete system compromise.
    This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-     Middle or compromise the boot server to be able to exploit this vulnerability successfully.
    (CVE-2023-40547)

  - A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition     operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is     further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes     memory corruption and can lead to a crash or data integrity issues during the boot phase. (CVE-2023-40548)

  - An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the     load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and     crashing Shim, resulting in a denial of service. (CVE-2023-40549)

  - An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue     may expose sensitive data during the system's boot phase. (CVE-2023-40550)

  - A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or     possible exposure of sensitive data during the system's boot phase. (CVE-2023-40551)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4042:01 advisory.

    * grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)
      * grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)
      * grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)
      * grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)
      * grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)
      * grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)
      * grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)
      * shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5099 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot     loader under secure boot environments.

    Security Fix(es):

    * grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)

    * grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)

    * grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)

    * grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)

    * grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)

    * grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)

    * grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)

    * shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5098 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot     loader under secure boot environments.

    Security Fix(es):

    * grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)

    * grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)

    * grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)

    * grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)

    * grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)

    * grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)

    * grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)

    * shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5095 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot     loader under secure boot environments.

    Security Fix(es):

    * grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)

    * grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)

    * grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)

    * grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)

    * grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)

    * grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)

    * grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)

    * shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5095 advisory.

  - A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may     lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be     considered Low as it's very complex to an attacker control the encoding and positioning of corrupted     Huffman entries to achieve results such as arbitrary code execution and/or secure boot circumvention. This     flaw affects grub2 versions prior grub-2.12. (CVE-2021-3696)

  - A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may     take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent     secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform     some triage over the heap layout to achieve signifcant results, also the values written into the memory     are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2     versions prior grub-2.12. (CVE-2021-3695)

  - A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data     to be written in heap. To a successful to be performed the attacker needs to perform some triage over the     heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data     corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions     prior grub-2.12. (CVE-2021-3697)

  - Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer     underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the     total_len value may end up wrapping around to a small integer number which will be used in memory     allocation. If the attack succeeds in such way, subsequent operations can write past the end of the     buffer. (CVE-2022-28733)

  - Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code     accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write     further when parsing the HTTP request, writing a NULL byte past the buffer. It's conceivable that an     attacker controlled set of packets can lead to corruption of the GRUB2's internal memory metadata.
    (CVE-2022-28734)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0134 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-3695:
    A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may     take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent     secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform     some triage over the heap layout to achieve signifcant results, also the values written into the memory     are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2     versions prior grub-2.12.

    CVE-2021-3696:
    A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may     lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be     considered Low as it's very complex to an attacker control the encoding and positioning of corrupted     Huffman entries to achieve results such as arbitrary code execution and/or secure boot circumvention. This     flaw affects grub2 versions prior grub-2.12.

    CVE-2021-3697:
    A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data     to be written in heap. To a successful to be performed the attacker needs to perform some triage over the     heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data     corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions     prior grub-2.12.

    CVE-2022-28733:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2022-28734:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2022-28735:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2022-28736:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2021-3981:
    A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong     permission set allowing non privileged users to read its content. This represents a low severity     confidentiality issue, as those users can eventually read any encrypted passwords present in grub.cfg.
    This flaw affects grub2 2.06 and previous versions. This issue has been fixed in grub upstream but no     version with the fix is currently released.

    CVE-2022-28737:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
193725	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : shim (SUSE-SU-2024:1368-1)	Nessus	SuSE Local Security Checks	2024/4/23	2024/4/23	high
194744	SUSE SLES15 Security Update : shim (SUSE-SU-2024:1461-1)	Nessus	SuSE Local Security Checks	2024/4/30	2024/4/30	high
292017	MiracleLinux 8 : grub2-2.02-123.el8.8.ML.1, mokutil-0.3.0-11.el8.1, shim-15.6-1.el8.ML.1, shim-unsigned-x64-15.6-1.el8.ML.1 (AXSA:2022-4042:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
162325	RHEL 9 : grub2, mokutil, shim, and shim-unsigned-x64 (RHSA-2022:5099)	Nessus	Red Hat Local Security Checks	2022/6/16	2024/11/7	high
162327	RHEL 8 : grub2, mokutil, and shim (RHSA-2022:5098)	Nessus	Red Hat Local Security Checks	2022/6/16	2024/11/7	high
162329	RHEL 8 : grub2, mokutil, shim, and shim-unsigned-x64 (RHSA-2022:5095)	Nessus	Red Hat Local Security Checks	2022/6/16	2024/11/7	high
162843	Rocky Linux 8 : grub2, mokutil, shim, and shim-unsigned-x64 (RLSA-2022:5095)	Nessus	Rocky Linux Local Security Checks	2022/7/8	2024/1/18	high
236599	Alibaba Cloud Linux 3 : 0134: grub2, mokutil, shim, and shim-unsigned-x64 (ALINUX3-SA-2022:0134)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high

检测

插件搜索

high

high

high

high

high

high

high

high