CVE-2023-48733

2024-02-1422:15:47

Debian Security Bug Tracker

security-tracker.debian.org

cve-2023-48733

ubuntu

edk2

uefi shell

secure boot

os-resident attacker

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.4

Confidence

High

EPSS

Percentile

15.5%

JSON

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu’s EDK2. This allows an OS-resident attacker to bypass Secure Boot.

OSVersionArchitecturePackageVersionFilename
Debian12alledk2< 2022.11-6+deb12u1edk2_2022.11-6+deb12u1_all.deb
Debian11alledk2< 2020.11-2+deb11u2edk2_2020.11-2+deb11u2_all.deb
Debian999alledk2< 2023.11-7edk2_2023.11-7_all.deb
Debian13alledk2< 2023.11-7edk2_2023.11-7_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	edk2	< 2022.11-6+deb12u1	edk2_2022.11-6+deb12u1_all.deb
Debian	11	all	edk2	< 2020.11-2+deb11u2	edk2_2020.11-2+deb11u2_all.deb
Debian	999	all	edk2	< 2023.11-7	edk2_2023.11-7_all.deb
Debian	13	all	edk2	< 2023.11-7	edk2_2023.11-7_all.deb