Ubuntu: USN-6638-1 (CVE-2023-48733): EDK II vulnerabilities

Ubuntu: USN-6638-1 (CVE-2023-48733): EDK II vulnerabilities

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

02/15/2024

Created

02/16/2024

Added

02/15/2024

Modified

10/23/2024

Description

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.

Solution(s)

• ubuntu-upgrade-efi-shell-aa64
• ubuntu-upgrade-efi-shell-arm
• ubuntu-upgrade-efi-shell-x64
• ubuntu-upgrade-ovmf
• ubuntu-upgrade-qemu-efi
• ubuntu-upgrade-qemu-efi-aarch64
• ubuntu-upgrade-qemu-efi-arm

References

• https://attackerkb.com/topics/cve-2023-48733
• CVE - 2023-48733
• USN-6638-1