Insecure Default in EDK2 Allows Bypass of Secure Boot
CVE-2023-48733

6.7MEDIUM

Key Information:

Vendor

Canonical Ltd.

Status
Ubuntu Edk Ii
Vendor
CVE Published:
14 February 2024

What is CVE-2023-48733?

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.

Affected Version(s)

Ubuntu EDK II Linux 0 < 2023.05-2ubuntu0.1

References

https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137
issue-tracking
https://nvd.nist.gov/vuln/detail/CVE-2023-48733
issue-tracking
https://www.openwall.com/lists/oss-security/2024/02/14/4
mailing-list

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mate Kukri
.