<div class="container">
<h1>Security update for shim</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2023:2086-1</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1185232">#1185232</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1185261">#1185261</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1185441">#1185441</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1185621">#1185621</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1187071">#1187071</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1187260">#1187260</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1193282">#1193282</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1193315">#1193315</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1198101">#1198101</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1198458">#1198458</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1201066">#1201066</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1202120">#1202120</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1205588">#1205588</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2022-28737.html">CVE-2022-28737</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2022-28737</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.4</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE CaaS Platform 4.0</li>
<li class="list-group-item">SUSE Enterprise Storage 7</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 15 SP1</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 15 SP2</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP1</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP2</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP1</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP2</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves one vulnerability, contains two features and has 12 fixes can now be installed.</p>
<h2>Description:</h2>
<p>This update for shim fixes the following issues:</p>
<ul>
<li>
<p>Updated shim signature after shim 15.7 be signed back:
signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458)</p>
</li>
<li>
<p>Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to
disable the NX compatibility flag when using post-process-pe because
grub2 is not ready. (bsc#1205588)</p>
</li>
<li>
<p>Enable the NX compatibility flag by default. (jsc#PED-127) </p>
</li>
</ul>
<p>Update to 15.7 (bsc#1198458) (jsc#PED-127):</p>
<ul>
<li>Make SBAT variable payload introspectable</li>
<li>Reference MokListRT instead of MokList</li>
<li>Add a link to the test plan in the readme.</li>
<li>[V3] Enable TDX measurement to RTMR register</li>
<li>Discard load-options that start with a NUL</li>
<li>Fixed load_cert_file bugs</li>
<li>Add -malign-double to IA32 compiler flags</li>
<li>pe: Fix image section entry-point validation</li>
<li>make-archive: Build reproducible tarball</li>
<li>mok: remove MokListTrusted from PCR 7</li>
</ul>
<p>Other fixes:</p>
<ul>
<li>
<p>Support enhance shim measurement to TD RTMR. (jsc#PED-1273) </p>
</li>
<li>
<p>shim-install: ensure grub.cfg created is not overwritten after installing grub related files</p>
</li>
<li>Add logic to shim.spec to only set sbat policy when efivarfs is writeable. (bsc#1201066)</li>
<li>Add logic to shim.spec for detecting --set-sbat-policy option before using mokutil to set sbat policy. (bsc#1202120)</li>
<li>Change the URL in SBAT section to mail:security@suse.de. (bsc#1193282)</li>
</ul>
<p>Update to 15.6 (bsc#1198458):</p>
<ul>
<li>MokManager: removed Locate graphic output protocol fail error message</li>
<li>shim: implement SBAT verification for the shim_lock protocol</li>
<li>post-process-pe: Fix a missing return code check</li>
<li>Update github actions matrix to be more useful</li>
<li>post-process-pe: Fix format string warnings on 32-bit platforms</li>
<li>Allow MokListTrusted to be enabled by default</li>
<li>Re-add ARM AArch64 support</li>
<li>Use ASCII as fallback if Unicode Box Drawing characters fail</li>
<li>make: don't treat cert.S specially</li>
<li>shim: use SHIM_DEVEL_VERBOSE when built in devel mode</li>
<li>Break out of the inner sbat loop if we find the entry.</li>
<li>Support loading additional certificates</li>
<li>Add support for NX (W^X) mitigations.</li>
<li>Fix preserve_sbat_uefi_variable() logic</li>
<li>SBAT Policy latest should be a one-shot</li>
<li>pe: Fix a buffer overflow when SizeOfRawData > VirtualSize</li>
<li>pe: Perform image verification earlier when loading grub</li>
<li>Update advertised sbat generation number for shim</li>
<li>Update SBAT generation requirements for 05/24/22</li>
<li>Also avoid CVE-2022-28737 in verify_image() by @vathpela</li>
</ul>
<p>Update to 15.5 (bsc#1198458):</p>
<ul>
<li>Broken ia32 relocs and an unimportant submodule change.</li>
<li>mok: allocate MOK config table as BootServicesData</li>
<li>Don't call QueryVariableInfo() on EFI 1.10 machines (bsc#1187260)</li>
<li>Relax the check for import_mok_state() (bsc#1185261)</li>
<li>SBAT.md: trivial changes</li>
<li>shim: another attempt to fix load options handling</li>
<li>Add tests for our load options parsing.</li>
<li>arm/aa64: fix the size of .rela* sections</li>
<li>mok: fix potential buffer overrun in import_mok_state</li>
<li>mok: relax the maximum variable size check</li>
<li>Don't unhook ExitBootServices when EBS protection is disabled</li>
<li>fallback: find_boot_option() needs to return the index for the boot entry in optnum</li>
<li>httpboot: Ignore case when checking HTTP headers</li>
<li>Fallback allocation errors</li>
<li>shim: avoid BOOTx64.EFI in message on other architectures</li>
<li>str: remove duplicate parameter check</li>
<li>fallback: add compile option FALLBACK_NONINTERACTIVE</li>
<li>Test mok mirror</li>
<li>Modify sbat.md to help with readability.</li>
<li>csv: detect end of csv file correctly</li>
<li>Specify that the .sbat section is ASCII not UTF-8</li>
<li>tests: add "include-fixed" GCC directory to include directories</li>
<li>pe: simplify generate_hash()</li>
<li>Don't make shim abort when TPM log event fails (RHBZ #2002265)</li>
<li>Fallback to default loader if parsed one does not exist</li>
<li>fallback: Fix for BootOrder crash when index returned</li>
<li>Better console checks</li>
<li>docs: update SBAT UEFI variable name</li>
<li>Don't parse load options if invoked from removable media path</li>
<li>fallback: fix fallback not passing arguments of the first boot option</li>
<li>shim: Don't stop forever at "Secure Boot not enabled" notification</li>
<li>Allocate mokvar table in runtime memory.</li>
<li>Remove post-process-pe on 'make clean'</li>
<li>
<p>pe: missing perror argument</p>
</li>
<li>
<p>CVE-2022-28737: Fixed a buffer overflow when SizeOfRawData > VirtualSize (bsc#1198458)</p>
</li>
<li>
<p>Add mokutil command to post script for setting sbat policy to latest mode
when the SbatPolicy-605dab50-e046-4300-abb6-3dd810dd8b23 is not created.
(bsc#1198458)</p>
</li>
<li>
<p>Updated vendor dbx binary and script (bsc#1198458)</p>
</li>
<li>
<p>Updated dbx-cert.tar.xz and vendor-dbx-sles.bin for adding
SLES-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.</p>
</li>
<li>Updated dbx-cert.tar.xz and vendor-dbx-opensuse.bin for adding
openSUSE-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.</li>
<li>Updated vendor-dbx.bin for adding SLES-UEFI-SIGN-Certificate-2021-05.crt
and openSUSE-UEFI-SIGN-Certificate-2021-05.crt for testing environment.</li>
<li>
<p>Updated generate-vendor-dbx.sh script for generating a vendor-dbx.bin
file which includes all .der for testing environment.</p>
</li>
<li>
<p>avoid buffer overflow when copying data to the MOK config table (bsc#1185232)</p>
</li>
<li>Disable exporting vendor-dbx to MokListXRT since writing a large RT variable could crash some machines (bsc#1185261)</li>
<li>ignore the odd LoadOptions length (bsc#1185232)</li>
<li>shim-install: reset def_shim_efi to "shim.efi" if the given file doesn't exist</li>
<li>relax the maximum variable size check for u-boot (bsc#1185621)</li>
<li>
<p>handle ignore_db and user_insecure_mode correctly (bsc#1185441, bsc#1187071)</p>
</li>
<li>
<p>Split the keys in vendor-dbx.bin to vendor-dbx-sles and
vendor-dbx-opensuse for shim-sles and shim-opensuse to reduce
the size of MokListXRT (bsc#1185261) </p>
</li>
<li>Also update generate-vendor-dbx.sh in dbx-cert.tar.xz</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE Important update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1
<br/>
<code>zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-2086=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2
<br/>
<code>zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-2086=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1
<br/>
<code>zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-2086=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2
<br/>
<code>zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-2086=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP Applications 15 SP1
<br/>
<code>zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-2086=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP Applications 15 SP2
<br/>
<code>zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-2086=1</code>
</li>
<li class="list-group-item">
SUSE Enterprise Storage 7
<br/>
<code>zypper in -t patch SUSE-Storage-7-2023-2086=1</code>
</li>
<li class="list-group-item">
SUSE CaaS Platform 4.0
<br/>
<span>
To install this update, use the SUSE CaaS Platform 'skuba' tool. It will
inform you if it detects new updates and let you then trigger updating of
the complete cluster in a controlled way.
</span>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (x86_64)
<ul>
<li>shim-debuginfo-15.7-150100.3.35.1</li>
<li>shim-15.7-150100.3.35.1</li>
<li>shim-debugsource-15.7-150100.3.35.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (x86_64)
<ul>
<li>shim-debuginfo-15.7-150100.3.35.1</li>
<li>shim-15.7-150100.3.35.1</li>
<li>shim-debugsource-15.7-150100.3.35.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (x86_64)
<ul>
<li>shim-debuginfo-15.7-150100.3.35.1</li>
<li>shim-15.7-150100.3.35.1</li>
<li>shim-debugsource-15.7-150100.3.35.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (x86_64)
<ul>
<li>shim-debuginfo-15.7-150100.3.35.1</li>
<li>shim-15.7-150100.3.35.1</li>
<li>shim-debugsource-15.7-150100.3.35.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (x86_64)
<ul>
<li>shim-debuginfo-15.7-150100.3.35.1</li>
<li>shim-15.7-150100.3.35.1</li>
<li>shim-debugsource-15.7-150100.3.35.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (x86_64)
<ul>
<li>shim-debuginfo-15.7-150100.3.35.1</li>
<li>shim-15.7-150100.3.35.1</li>
<li>shim-debugsource-15.7-150100.3.35.1</li>
</ul>
</li>
<li>
SUSE Enterprise Storage 7 (x86_64)
<ul>
<li>shim-debuginfo-15.7-150100.3.35.1</li>
<li>shim-15.7-150100.3.35.1</li>
<li>shim-debugsource-15.7-150100.3.35.1</li>
</ul>
</li>
<li>
SUSE CaaS Platform 4.0 (x86_64)
<ul>
<li>shim-debuginfo-15.7-150100.3.35.1</li>
<li>shim-15.7-150100.3.35.1</li>
<li>shim-debugsource-15.7-150100.3.35.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2022-28737.html">https://www.suse.com/security/cve/CVE-2022-28737.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1185232">https://bugzilla.suse.com/show_bug.cgi?id=1185232</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1185261">https://bugzilla.suse.com/show_bug.cgi?id=1185261</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1185441">https://bugzilla.suse.com/show_bug.cgi?id=1185441</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1185621">https://bugzilla.suse.com/show_bug.cgi?id=1185621</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1187071">https://bugzilla.suse.com/show_bug.cgi?id=1187071</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1187260">https://bugzilla.suse.com/show_bug.cgi?id=1187260</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1193282">https://bugzilla.suse.com/show_bug.cgi?id=1193282</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1193315">https://bugzilla.suse.com/show_bug.cgi?id=1193315</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1198101">https://bugzilla.suse.com/show_bug.cgi?id=1198101</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1198458">https://bugzilla.suse.com/show_bug.cgi?id=1198458</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1201066">https://bugzilla.suse.com/show_bug.cgi?id=1201066</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1202120">https://bugzilla.suse.com/show_bug.cgi?id=1202120</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1205588">https://bugzilla.suse.com/show_bug.cgi?id=1205588</a>
</li>
<li>
<a href="https://jira.suse.com/browse/PED-127">https://jira.suse.com/browse/PED-127</a>
</li>
<li>
<a href="https://jira.suse.com/browse/PED-1273">https://jira.suse.com/browse/PED-1273</a>
</li>
</ul>
</div>