RedHat: RHSA-2021-1734:01 Moderate: shim security update | LinuxSec...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: shim security update
Advisory ID:       RHSA-2021:1734-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:1734
Issue date:        2021-05-18
CVE Names:         CVE-2020-14372 CVE-2020-25632 CVE-2020-25647 
                   CVE-2020-27749 CVE-2020-27779 CVE-2021-20225 
                   CVE-2021-20233 
=====================================================================

1. Summary:

An update for shim, shim-unsigned-aarch64, and shim-unsigned-x64 is now
available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat CodeReady Linux Builder (v. 8) - aarch64, x86_64
Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, x86_64

3. Description:

The shim package contains a first-stage UEFI boot loader that handles
chaining to a trusted full boot loader under secure boot environments.

Security Fix(es):

* grub2: acpi command allows privileged user to load crafted ACPI tables
when Secure Boot is enabled (CVE-2020-14372)

* grub2: Use-after-free in rmmod command (CVE-2020-25632)

* grub2: Out-of-bounds write in grub_usb_device_initialize()
(CVE-2020-25647)

* grub2: Stack buffer overflow in grub_parser_split_cmdline()
(CVE-2020-27749)

* grub2: cutmem command allows privileged user to remove memory regions
when Secure Boot is enabled (CVE-2020-27779)

* grub2: Heap out-of-bounds write in short form option parser
(CVE-2021-20225)

* grub2: Heap out-of-bounds write due to miscalculation of space required
for quoting (CVE-2021-20233)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.4 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1873150 - CVE-2020-14372 grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled
1879577 - CVE-2020-25632 grub2: Use-after-free in rmmod command
1886936 - CVE-2020-25647 grub2: Out-of-bounds write in grub_usb_device_initialize()
1899966 - CVE-2020-27749 grub2: Stack buffer overflow in grub_parser_split_cmdline()
1900698 - CVE-2020-27779 grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled
1924696 - CVE-2021-20225 grub2: Heap out-of-bounds write in short form option parser
1926263 - CVE-2021-20233 grub2: Heap out-of-bounds write due to miscalculation of space required for quoting

6. Package List:

Red Hat Enterprise Linux BaseOS (v. 8):

Source:
shim-15.4-2.el8_1.src.rpm

aarch64:
shim-aa64-15.4-2.el8_1.aarch64.rpm

x86_64:
shim-ia32-15.4-2.el8_1.x86_64.rpm
shim-x64-15.4-2.el8_1.x86_64.rpm

Red Hat CodeReady Linux Builder (v. 8):

Source:
shim-unsigned-aarch64-15-7.el8_1.src.rpm
shim-unsigned-x64-15.4-4.el8_1.src.rpm

aarch64:
shim-unsigned-aarch64-15-7.el8_1.aarch64.rpm

x86_64:
shim-unsigned-x64-15.4-4.el8_1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-14372
https://access.redhat.com/security/cve/CVE-2020-25632
https://access.redhat.com/security/cve/CVE-2020-25647
https://access.redhat.com/security/cve/CVE-2020-27749
https://access.redhat.com/security/cve/CVE-2020-27779
https://access.redhat.com/security/cve/CVE-2021-20225
https://access.redhat.com/security/cve/CVE-2021-20233
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/security/vulnerabilities/RHSB-2021-003
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYKPvONzjgjWX9erEAQjW0w/+OZydzjEMfioyPxScc1pCQWrHoiFX5jZt
XnFJCEaMTZZ4g2yx+oRyyJM8Jrd7suk1NAhUDh4V5LkdRk4oaXbtkcLBcOJHTfGV
pzcfX3A/kJZ2ZsKogV5Orh06Jiq6aGwsg0YiGoDp4EmG+PGnODMtWvjB8U6KSi1/
aIg19yHmlIVkTaYJQan2LpL7r3pknZyHmuSZPdJxJX7/8coGS7s9rqGwROYnJnHE
jiGAVqahVZkHYgvMzjo15occFVr/91C0oCb3GhI2Be1QI+Dvz2VT/xs+aIbum2yZ
ioEGBVr9W/f6R8PvwIE+PTkOE2IXqJ/0uO1xuJz/bvdulC+5hXxtsG4RWWW6Sk22
uUN2GNpwF+fF6K4cZ3sdx09U5SHDuUTe1ZIjHALm7sxL4ixpEaptSsJcLoOqjg9/
36T4REDa90NeY75SpdXNvqQqH8b6rImiTrg8Wvh16lxTT8T+1iAym6sPWb3d/0RP
tQ+Dzbvp+ramwsSaATz4BhkmdkDZlaN/Soll5ZPu3Oi3imC/Ocjem2t8MD6sWHLD
bwoYx8UXkvsPfu7gzDSmc84PGjl9wcq4AT9wAdZY4rgKwqlbGrBObHKi8tlZ8y3m
jwrocmABVkLWYG2s1DqH4LXm8MA1Ka4dmKhRT13BmiTM0h01LeGMCOuPUU2pWW55
6QkP54EN3Hg=
=PExu
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2021-1734:01 Moderate: shim security update

An update for shim, shim-unsigned-aarch64, and shim-unsigned-x64 is now available for Red Hat Enterprise Linux 8

Summary

The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.
Security Fix(es):
* grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled (CVE-2020-14372)
* grub2: Use-after-free in rmmod command (CVE-2020-25632)
* grub2: Out-of-bounds write in grub_usb_device_initialize() (CVE-2020-25647)
* grub2: Stack buffer overflow in grub_parser_split_cmdline() (CVE-2020-27749)
* grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled (CVE-2020-27779)
* grub2: Heap out-of-bounds write in short form option parser (CVE-2021-20225)
* grub2: Heap out-of-bounds write due to miscalculation of space required for quoting (CVE-2021-20233)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2020-14372 https://access.redhat.com/security/cve/CVE-2020-25632 https://access.redhat.com/security/cve/CVE-2020-25647 https://access.redhat.com/security/cve/CVE-2020-27749 https://access.redhat.com/security/cve/CVE-2020-27779 https://access.redhat.com/security/cve/CVE-2021-20225 https://access.redhat.com/security/cve/CVE-2021-20233 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/security/vulnerabilities/RHSB-2021-003 https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/

Package List

Red Hat Enterprise Linux BaseOS (v. 8):
Source: shim-15.4-2.el8_1.src.rpm
aarch64: shim-aa64-15.4-2.el8_1.aarch64.rpm
x86_64: shim-ia32-15.4-2.el8_1.x86_64.rpm shim-x64-15.4-2.el8_1.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 8):
Source: shim-unsigned-aarch64-15-7.el8_1.src.rpm shim-unsigned-x64-15.4-4.el8_1.src.rpm
aarch64: shim-unsigned-aarch64-15-7.el8_1.aarch64.rpm
x86_64: shim-unsigned-x64-15.4-4.el8_1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2021:1734-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:1734
Issued Date: : 2021-05-18
CVE Names: CVE-2020-14372 CVE-2020-25632 CVE-2020-25647 CVE-2020-27749 CVE-2020-27779 CVE-2021-20225 CVE-2021-20233

Topic

An update for shim, shim-unsigned-aarch64, and shim-unsigned-x64 is nowavailable for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

Red Hat CodeReady Linux Builder (v. 8) - aarch64, x86_64

Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, x86_64

Bugs Fixed

1873150 - CVE-2020-14372 grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled

1879577 - CVE-2020-25632 grub2: Use-after-free in rmmod command

1886936 - CVE-2020-25647 grub2: Out-of-bounds write in grub_usb_device_initialize()

1899966 - CVE-2020-27749 grub2: Stack buffer overflow in grub_parser_split_cmdline()

1900698 - CVE-2020-27779 grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled

1924696 - CVE-2021-20225 grub2: Heap out-of-bounds write in short form option parser

1926263 - CVE-2021-20233 grub2: Heap out-of-bounds write due to miscalculation of space required for quoting

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.