RedHat: RHSA-2021-3675:01 Moderate: shim and fwupd security update

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: shim and fwupd security update
Advisory ID:       RHSA-2021:3675-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:3675
Issue date:        2021-09-28
CVE Names:         CVE-2020-14372 CVE-2020-25632 CVE-2020-25647 
                   CVE-2020-27749 CVE-2020-27779 CVE-2021-20225 
                   CVE-2021-20233 
=====================================================================

1. Summary:

An update for fwupd, shim, shim-unsigned-aarch64, and shim-unsigned-x64 is
now available for Red Hat Enterprise Linux 8.1 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat CodeReady Linux Builder EUS (v. 8.1) - aarch64, x86_64
Red Hat Enterprise Linux BaseOS EUS (v. 8.1) - aarch64, ppc64le, s390x, x86_64

3. Description:

The shim package contains a first-stage UEFI boot loader that handles
chaining to a trusted full boot loader under secure boot environments.

The fwupd packages provide a service that allows session software to update
device firmware.

The following packages have been upgraded to a later upstream version: shim
(15.4). (BZ#1932410)

Security Fix(es):

* grub2: acpi command allows privileged user to load crafted ACPI tables
when Secure Boot is enabled (CVE-2020-14372)

* grub2: Use-after-free in rmmod command (CVE-2020-25632)

* grub2: Out-of-bounds write in grub_usb_device_initialize()
(CVE-2020-25647)

* grub2: Stack buffer overflow in grub_parser_split_cmdline()
(CVE-2020-27749)

* grub2: cutmem command allows privileged user to remove memory regions
when Secure Boot is enabled (CVE-2020-27779)

* grub2: Heap out-of-bounds write in short form option parser
(CVE-2021-20225)

* grub2: Heap out-of-bounds write due to miscalculation of space required
for quoting (CVE-2021-20233)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1873150 - CVE-2020-14372 grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled
1879577 - CVE-2020-25632 grub2: Use-after-free in rmmod command
1886936 - CVE-2020-25647 grub2: Out-of-bounds write in grub_usb_device_initialize()
1899966 - CVE-2020-27749 grub2: Stack buffer overflow in grub_parser_split_cmdline()
1900698 - CVE-2020-27779 grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled
1924696 - CVE-2021-20225 grub2: Heap out-of-bounds write in short form option parser
1926263 - CVE-2021-20233 grub2: Heap out-of-bounds write due to miscalculation of space required for quoting

6. Package List:

Red Hat Enterprise Linux BaseOS EUS (v. 8.1):

Source:
fwupd-1.1.4-4.el8_1.src.rpm
shim-15.4-2.el8_1.src.rpm

aarch64:
fwupd-1.1.4-4.el8_1.aarch64.rpm
fwupd-debuginfo-1.1.4-4.el8_1.aarch64.rpm
fwupd-debugsource-1.1.4-4.el8_1.aarch64.rpm
shim-aa64-15.4-2.el8_1.aarch64.rpm

ppc64le:
fwupd-1.1.4-4.el8_1.ppc64le.rpm
fwupd-debuginfo-1.1.4-4.el8_1.ppc64le.rpm
fwupd-debugsource-1.1.4-4.el8_1.ppc64le.rpm

s390x:
fwupd-1.1.4-4.el8_1.s390x.rpm
fwupd-debuginfo-1.1.4-4.el8_1.s390x.rpm
fwupd-debugsource-1.1.4-4.el8_1.s390x.rpm

x86_64:
fwupd-1.1.4-4.el8_1.x86_64.rpm
fwupd-debuginfo-1.1.4-4.el8_1.x86_64.rpm
fwupd-debugsource-1.1.4-4.el8_1.x86_64.rpm
shim-ia32-15.4-2.el8_1.x86_64.rpm
shim-x64-15.4-2.el8_1.x86_64.rpm

Red Hat CodeReady Linux Builder EUS (v. 8.1):

Source:
shim-unsigned-aarch64-15-7.el8_1.src.rpm
shim-unsigned-x64-15.4-4.el8_1.src.rpm

aarch64:
shim-unsigned-aarch64-15-7.el8_1.aarch64.rpm

x86_64:
shim-unsigned-x64-15.4-4.el8_1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-14372
https://access.redhat.com/security/cve/CVE-2020-25632
https://access.redhat.com/security/cve/CVE-2020-25647
https://access.redhat.com/security/cve/CVE-2020-27749
https://access.redhat.com/security/cve/CVE-2020-27779
https://access.redhat.com/security/cve/CVE-2021-20225
https://access.redhat.com/security/cve/CVE-2021-20233
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/security/vulnerabilities/RHSB-2021-003

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYVMoXNzjgjWX9erEAQhsGQ/+IXv7ouaquc1VJd6BSCD53UUNjV/pzck7
7wqvfvz4gIpMbgPH/yBMsiJeBRzl+5VlaERYp0S8o35npwokQO7TQP8+CVEi/yCy
yq32XWSPquUYo7HPRJaxU9lIQmH7aq6uM/FM4/NA+Bgxo55Pidr6JNwo1hQXUCxp
V4GptlYCbaSpBG3yADRxY4ALaxtSnSGH/V9iZvzOS/4d6ma8y+lbOAZHylOE99LK
WLJRq/L+BmmTLLvHMwZkjmkQkNX44bADHwP4Tc2eeeaW3IUglUfl64k0Hb69tt7q
Ny3xevJobRQGxfc5U59+qgAMlFTR6nldnivFxusWzzLxVQKjFDxUoxj5R0m+LQrI
4jQph1UAHgKyya791R7aNMQtsYs1Dqwio1prbktqy+QPganCagnddWMbytN3lM7o
q2+2Q1NT7yB01CnMeBM94Xn3TS4TAUmfhZLJfDvMesjjFX+RrBs1L4JkHl7iXsTq
TDH8QNA+q94Xk+8CjHALszzLh3+LdkvoHVN0BWZTT8ElQ8ZNy0dQd+gEZh4F3DSa
4DzCklBeQNmJMuLkbbsaTYphMR5l8m5S0bIOqXMUMaiIpmXflS14x+xnyhyCzyXl
YV+V/dUbTbS8ou5/xEZaJ/mArPMrYF8Nb8vJ7tsh0XtH3XTdZPFf6hCSd86V51Fp
Pkc98lCNM88=
=+0q2
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2021-3675:01 Moderate: shim and fwupd security update

An update for fwupd, shim, shim-unsigned-aarch64, and shim-unsigned-x64 is now available for Red Hat Enterprise Linux 8.1 Extended Update Support

Summary

The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.
The fwupd packages provide a service that allows session software to update device firmware.
The following packages have been upgraded to a later upstream version: shim (15.4). (BZ#1932410)
Security Fix(es):
* grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled (CVE-2020-14372)
* grub2: Use-after-free in rmmod command (CVE-2020-25632)
* grub2: Out-of-bounds write in grub_usb_device_initialize() (CVE-2020-25647)
* grub2: Stack buffer overflow in grub_parser_split_cmdline() (CVE-2020-27749)
* grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled (CVE-2020-27779)
* grub2: Heap out-of-bounds write in short form option parser (CVE-2021-20225)
* grub2: Heap out-of-bounds write due to miscalculation of space required for quoting (CVE-2021-20233)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2020-14372 https://access.redhat.com/security/cve/CVE-2020-25632 https://access.redhat.com/security/cve/CVE-2020-25647 https://access.redhat.com/security/cve/CVE-2020-27749 https://access.redhat.com/security/cve/CVE-2020-27779 https://access.redhat.com/security/cve/CVE-2021-20225 https://access.redhat.com/security/cve/CVE-2021-20233 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/security/vulnerabilities/RHSB-2021-003

Package List

Red Hat Enterprise Linux BaseOS EUS (v. 8.1):
Source: fwupd-1.1.4-4.el8_1.src.rpm shim-15.4-2.el8_1.src.rpm
aarch64: fwupd-1.1.4-4.el8_1.aarch64.rpm fwupd-debuginfo-1.1.4-4.el8_1.aarch64.rpm fwupd-debugsource-1.1.4-4.el8_1.aarch64.rpm shim-aa64-15.4-2.el8_1.aarch64.rpm
ppc64le: fwupd-1.1.4-4.el8_1.ppc64le.rpm fwupd-debuginfo-1.1.4-4.el8_1.ppc64le.rpm fwupd-debugsource-1.1.4-4.el8_1.ppc64le.rpm
s390x: fwupd-1.1.4-4.el8_1.s390x.rpm fwupd-debuginfo-1.1.4-4.el8_1.s390x.rpm fwupd-debugsource-1.1.4-4.el8_1.s390x.rpm
x86_64: fwupd-1.1.4-4.el8_1.x86_64.rpm fwupd-debuginfo-1.1.4-4.el8_1.x86_64.rpm fwupd-debugsource-1.1.4-4.el8_1.x86_64.rpm shim-ia32-15.4-2.el8_1.x86_64.rpm shim-x64-15.4-2.el8_1.x86_64.rpm
Red Hat CodeReady Linux Builder EUS (v. 8.1):
Source: shim-unsigned-aarch64-15-7.el8_1.src.rpm shim-unsigned-x64-15.4-4.el8_1.src.rpm
aarch64: shim-unsigned-aarch64-15-7.el8_1.aarch64.rpm
x86_64: shim-unsigned-x64-15.4-4.el8_1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2021:3675-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:3675
Issued Date: : 2021-09-28
CVE Names: CVE-2020-14372 CVE-2020-25632 CVE-2020-25647 CVE-2020-27749 CVE-2020-27779 CVE-2021-20225 CVE-2021-20233

Topic

An update for fwupd, shim, shim-unsigned-aarch64, and shim-unsigned-x64 isnow available for Red Hat Enterprise Linux 8.1 Extended Update Support.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

Red Hat CodeReady Linux Builder EUS (v. 8.1) - aarch64, x86_64

Red Hat Enterprise Linux BaseOS EUS (v. 8.1) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

1873150 - CVE-2020-14372 grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled

1879577 - CVE-2020-25632 grub2: Use-after-free in rmmod command

1886936 - CVE-2020-25647 grub2: Out-of-bounds write in grub_usb_device_initialize()

1899966 - CVE-2020-27749 grub2: Stack buffer overflow in grub_parser_split_cmdline()

1900698 - CVE-2020-27779 grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled

1924696 - CVE-2021-20225 grub2: Heap out-of-bounds write in short form option parser

1926263 - CVE-2021-20233 grub2: Heap out-of-bounds write due to miscalculation of space required for quoting

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.