mbox series

[0/3] Regarding efibootguard CVE-2023-39950

Message ID 20230816092424.203252-1-michael.adler@siemens.com
Headers show
Series Regarding efibootguard CVE-2023-39950 | expand

Message

Michael Adler Aug. 16, 2023, 9:24 a.m. UTC 
Hi all,

A recent CVE [1] has been assigned to efibootguard. Given that SWUpdate
integrates with efibootguard, we investigated its exploitability within
SWUpdate. Our findings indicate that you remain safe as long as you refrain
from using user-defined efibootguard variables - which SWUpdate doesn't do by
default. However, it is possible to write custom Lua code that reads/writes
user-defined variables in which case you **might** be affected.

It's worth noting that while we didn't find a way to exploit the CVE in a
standard SWUpdate deployment, it's still recommended to update to efibootguard
version 0.15 or newer if you're using both SWUpdate and efibootguard.

During my analysis, I discovered some minor issues in SWUpdate's efibootguard
integration. These have been addressed in this patch series.

Kind regards,
  Michael

[1] https://www.cve.org/CVERecord?id=CVE-2023-39950

Michael Adler (3):
  ebg: ensure env_get returns valid strings
  ebg: detailed logging if malloc fails
  ebg: fix integer underflow

 bootloader/ebg.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

Comments

Michael Adler Sept. 19, 2023, 8:08 a.m. UTC | #1 
Just a friendly ping so that we don't forget this (it's security-related).

Kind Regards,
  Michael
Stefano Babic Sept. 19, 2023, 9:33 a.m. UTC | #2 
On 19.09.23 10:08, 'Michael Adler' via swupdate wrote:
> Just a friendly ping so that we don't forget this (it's security-related).
> 

Thanks for remind, I haǘe applied your series to -master.

Best regards,
Stefano

> Kind Regards,
>    Michael
>