Insecure Default in EDK2 Allows Bypass of Secure Boot
CVE-2023-48733

6.7MEDIUM

Key Information:

Vendor: Canonical Ltd.
Status: Ubuntu Edk Ii
Vendor: CVE Published:; 14 February 2024

Summary

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.

Affected Version(s)

Ubuntu EDK II Linux 0 < 2023.05-2ubuntu0.1

References

https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137

https://nvd.nist.gov/vuln/detail/CVE-2023-48733

https://www.openwall.com/lists/oss-security/2024/02/14/4

CVSS V3.1

Score:

6.7

Severity:

MEDIUM

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Feb 14, 2024
Vulnerability Reserved
Dec 5, 2023

Credit

Mate Kukri

.