SUSE-SU-2024:1368-1

    Dashboard / Vulnerabilities / SUSE-SU-2024:1368-1

    SUSE-SU-2024:1368-1

    Published: 22 Apr 2024Last Modified: 2 May 2025

    Summary: Security update for shim

    Details: This update for shim fixes the following issues: - Update shim-install to set the TPM2 SRK algorithm (bsc#1213945) - Limit the requirement of fde-tpm-helper-macros to the distro with suse_version 1600 and above (bsc#1219460) Update to version 15.8: Security issues fixed: - mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546) - avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547) - Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548) - Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549) - pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550) - pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551) The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now. - Generate dbx during build so we don't include binary files in sources - Don't require grub so shim can still be used with systemd-boot - Update shim-install to fix boot failure of ext4 root file system on RAID10 (bsc#1205855) - Adopt the macros from fde-tpm-helper-macros to update the signature in the sealed key after a bootloader upgrade - Update shim-install to amend full disk encryption support - Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector - Use the long name to specify the grub2 key protector - cryptodisk: support TPM authorized policies - Do not use tpm_record_pcrs unless the command is in command.lst - Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to enable the NX compatibility flag when using post-process-pe after discussed with grub2 experts in mail. It's useful for further development and testing. (bsc#1205588)

    References: https://www.suse.com/support/update/announcement/2024/suse-su-20241368-1/, https://bugzilla.suse.com/1198101, https://bugzilla.suse.com/1205588, https://bugzilla.suse.com/1205855, https://bugzilla.suse.com/1210382, https://bugzilla.suse.com/1213945, https://bugzilla.suse.com/1215098, https://bugzilla.suse.com/1215099, https://bugzilla.suse.com/1215100, https://bugzilla.suse.com/1215101, https://bugzilla.suse.com/1215102, https://bugzilla.suse.com/1215103, https://bugzilla.suse.com/1219460, https://www.suse.com/security/cve/CVE-2022-28737, https://www.suse.com/security/cve/CVE-2023-40546, https://www.suse.com/security/cve/CVE-2023-40547, https://www.suse.com/security/cve/CVE-2023-40548, https://www.suse.com/security/cve/CVE-2023-40549, https://www.suse.com/security/cve/CVE-2023-40550, https://www.suse.com/security/cve/CVE-2023-40551

    Affected packages

    Package

    Name: shim

    Purl: pkg:rpm/suse/shim&distro=SUSE%20Linux%20Enterprise%20Micro%205.3

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -15.8-150300.4.20.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2024:1368-1 | CVE-DB