Integer Overflow or Wraparound Affecting shim-aa64 package, versions <0:15.8-2.el8
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL8-SHIMAA64-6650841
- published 18 Apr 2024
- disclosed 3 Oct 2023
How to fix?
Upgrade RHEL:8 shim-aa64 to version 0:15.8-2.el8 or higher.
This issue was patched in RHSA-2024:1883.
NVD Description
Note: Versions mentioned in the description apply only to the upstream shim-aa64 package and not the shim-aa64 package as distributed by RHEL.
See How to fix? for RHEL:8 relevant fixed versions and status.
A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.