VULNERABILITY INTELLIGENCE

CVE-2022-28737

CVSS score6.5 MEDIUM

EPSS probability0.33%

CISA KEVNot currently listed

Published2023-07-20

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Description

There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.

Weakness classification

nvd@nist.gov: CWE-787

Primary references

security@ubuntu.com — Third Party Advisory
security@ubuntu.com — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory