PT-2023-4426 · Unknown · Efibootguard

Onionpsy · Published 2023-08-14 · Updated 2023-08-22 · CVE-2023-39950

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions efibootguard versions prior to v0.15

Description The issue exists due to insufficient validation and sanitization of input from untrustworthy bootloader environment files, which can cause crashes and potentially allow code injections into bg setenv or programs using libebgenv. This is triggered when the affected components try to modify a manipulated environment, specifically its user variables. Furthermore, bg printenv may crash over invalid read accesses or report invalid results.

Recommendations To resolve the issue, update the efibootguard library and tools to version v0.15 or later. Additionally, update programs that are statically linked against it. As a temporary workaround, consider avoiding accesses to user variables, specifically modifications to them, until the update is applied. Note that an update of the bootloader EFI executable is not required.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-04771

CVE-2023-39950

GHSA-J6PP-7G99-24M7

Affected Products

Efibootguard

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39950.json · Exploit
• https://ubuntu.com/security/CVE-2023-39950 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-39950 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-39950 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-39950 · Security Note
• https://bdu.fstec.ru/vul/2023-04771 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39950 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-39950 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-39950 · Vendor Advisory
• https://github.com/siemens/efibootguard/blob/master/docs/TOOLS.md#setting-user-variables · Note
• https://github.com/siemens/efibootguard/tags · Note
• https://github.com/siemens/efibootguard/security/advisories/GHSA-j6pp-7g99-24m7 · Note
• https://github.com/siemens/efibootguard/blob/master/docs/API.md · Note
• https://github.com/siemens/efibootguard/blob/master/docs/TOOLS.md · Note
• https://github.com/siemens/efibootguard/commit/53dee61dc8b3a83c882e4bc9a0cfe7d6d73610c4 · Note