<div class="container">
    <h1>Security update for shim</h1>

    <table class="table table-striped table-bordered">
        <tbody>
        <tr>
            <th>Announcement ID:</th>
            <td>SUSE-SU-2023:1863-1</td>
        </tr>
        
        <tr>
            <th>Rating:</th>
            <td>important</td>
        </tr>
        <tr>
            <th>References:</th>
            <td>
                <ul>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1185232">bsc#1185232</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1185261">bsc#1185261</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1185441">bsc#1185441</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1185621">bsc#1185621</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1187071">bsc#1187071</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1187260">bsc#1187260</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1193282">bsc#1193282</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1193315">bsc#1193315</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1198458">bsc#1198458</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1201066">bsc#1201066</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1202120">bsc#1202120</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://bugzilla.suse.com/show_bug.cgi?id=1205588">bsc#1205588</a>
                        </li>
                    
                    
                        <li style="display: inline;">
                            <a href="https://jira.suse.com/browse/PED-127">jsc#PED-127</a>
                        </li>
                    
                        <li style="display: inline;">
                            <a href="https://jira.suse.com/browse/PED-1273">jsc#PED-1273</a>
                        </li>
                    
                </ul>
            </td>
        </tr>
        
            <tr>
                <th>
                    Cross-References:
                </th>
                <td>
                    <ul>
                    
                        <li style="display: inline;">
                            <a href="https://www.suse.com/security/cve/CVE-2022-28737.html">CVE-2022-28737</a>
                        </li>
                    
                    </ul>
                </td>
            </tr>
            <tr>
                <th>CVSS scores:</th>
                <td>
                    <ul class="list-group">
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2022-28737</span>
                                <span class="cvss-source">
                                    (
                                    
                                        SUSE
                                    
                                    ):
                                </span>
                                <span class="cvss-score">8.4</span>
                                <span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
                            </li>
                        
                            <li class="list-group-item">
                                <span class="cvss-reference">CVE-2022-28737</span>
                                <span class="cvss-source">
                                    (
                                    
                                        NVD
                                    
                                    ):
                                </span>
                                <span class="cvss-score">6.5</span>
                                <span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H</span>
                            </li>
                        
                    </ul>
                </td>
            </tr>
        
        <tr>
            <th>Affected Products:</th>
            <td>
                <ul class="list-group">
                    
                        <li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP4</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP5</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise Server 12 SP4</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise Server 12 SP5</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP4</li>
                    
                        <li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP5</li>
                    
                        <li class="list-group-item">SUSE OpenStack Cloud 9</li>
                    
                        <li class="list-group-item">SUSE OpenStack Cloud Crowbar 9</li>
                    
                </ul>
            </td>
        </tr>
        </tbody>
    </table>

    <p>An update that solves one vulnerability, contains two features and has 11 security fixes can now be installed.</p>

    


    
        <h2>Description:</h2>
    
    <p>This update for shim fixes the following issues:</p>
<ul>
<li>
<p>Updated shim signature after shim 15.7 be signed back:
  signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458)</p>
</li>
<li>
<p>Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to
  disable the NX compatibility flag when using post-process-pe because
  grub2 is not ready. (bsc#1205588)</p>
</li>
<li>
<p>Enable the NX compatibility flag by default. (jsc#PED-127) </p>
</li>
</ul>
<p>Update to 15.7 (bsc#1198458) (jsc#PED-127):</p>
<ul>
<li>Make SBAT variable payload introspectable</li>
<li>Reference MokListRT instead of MokList</li>
<li>Add a link to the test plan in the readme.</li>
<li>[V3] Enable TDX measurement to RTMR register</li>
<li>Discard load-options that start with a NUL</li>
<li>Fixed load_cert_file bugs</li>
<li>Add -malign-double to IA32 compiler flags</li>
<li>pe: Fix image section entry-point validation</li>
<li>make-archive: Build reproducible tarball</li>
<li>mok: remove MokListTrusted from PCR 7</li>
</ul>
<p>Other fixes:</p>
<ul>
<li>
<p>Support enhance shim measurement to TD RTMR. (jsc#PED-1273) </p>
</li>
<li>
<p>shim-install: ensure grub.cfg created is not overwritten after installing grub related files</p>
</li>
<li>Add logic to shim.spec to only set sbat policy when efivarfs is writeable.  (bsc#1201066)</li>
<li>Add logic to shim.spec for detecting --set-sbat-policy option before using mokutil to set sbat policy. (bsc#1202120)</li>
<li>Change the URL in SBAT section to mail:security@suse.de. (bsc#1193282)</li>
</ul>
<p>Update to 15.6 (bsc#1198458):</p>
<ul>
<li>MokManager: removed Locate graphic output protocol fail error message</li>
<li>shim: implement SBAT verification for the shim_lock protocol</li>
<li>post-process-pe: Fix a missing return code check</li>
<li>Update github actions matrix to be more useful</li>
<li>post-process-pe: Fix format string warnings on 32-bit platforms</li>
<li>Allow MokListTrusted to be enabled by default</li>
<li>Re-add ARM AArch64 support</li>
<li>Use ASCII as fallback if Unicode Box Drawing characters fail</li>
<li>make: don&#x27;t treat cert.S specially</li>
<li>shim: use SHIM_DEVEL_VERBOSE when built in devel mode</li>
<li>Break out of the inner sbat loop if we find the entry.</li>
<li>Support loading additional certificates</li>
<li>Add support for NX (W^X) mitigations.</li>
<li>Fix preserve_sbat_uefi_variable() logic</li>
<li>SBAT Policy latest should be a one-shot</li>
<li>pe: Fix a buffer overflow when SizeOfRawData > VirtualSize</li>
<li>pe: Perform image verification earlier when loading grub</li>
<li>Update advertised sbat generation number for shim</li>
<li>Update SBAT generation requirements for 05/24/22</li>
<li>Also avoid CVE-2022-28737 in verify_image() by @vathpela</li>
</ul>
<p>Update to 15.5 (bsc#1198458):</p>
<ul>
<li>Broken ia32 relocs and an unimportant submodule change.</li>
<li>mok: allocate MOK config table as BootServicesData</li>
<li>Don&#x27;t call QueryVariableInfo() on EFI 1.10 machines (bsc#1187260)</li>
<li>Relax the check for import_mok_state()  (bsc#1185261)</li>
<li>SBAT.md: trivial changes</li>
<li>shim: another attempt to fix load options handling</li>
<li>Add tests for our load options parsing.</li>
<li>arm/aa64: fix the size of .rela* sections</li>
<li>mok: fix potential buffer overrun in import_mok_state</li>
<li>mok: relax the maximum variable size check</li>
<li>Don&#x27;t unhook ExitBootServices when EBS protection is disabled</li>
<li>fallback: find_boot_option() needs to return the index for the boot entry in optnum</li>
<li>httpboot: Ignore case when checking HTTP headers</li>
<li>Fallback allocation errors</li>
<li>shim: avoid BOOTx64.EFI in message on other architectures</li>
<li>str: remove duplicate parameter check</li>
<li>fallback: add compile option FALLBACK_NONINTERACTIVE</li>
<li>Test mok mirror</li>
<li>Modify sbat.md to help with readability.</li>
<li>csv: detect end of csv file correctly</li>
<li>Specify that the .sbat section is ASCII not UTF-8</li>
<li>tests: add "include-fixed" GCC directory to include directories</li>
<li>pe: simplify generate_hash()</li>
<li>Don&#x27;t make shim abort when TPM log event fails (RHBZ #2002265)</li>
<li>Fallback to default loader if parsed one does not exist</li>
<li>fallback: Fix for BootOrder crash when index returned</li>
<li>Better console checks</li>
<li>docs: update SBAT UEFI variable name</li>
<li>Don&#x27;t parse load options if invoked from removable media path</li>
<li>fallback: fix fallback not passing arguments of the first boot option</li>
<li>shim: Don&#x27;t stop forever at "Secure Boot not enabled" notification</li>
<li>Allocate mokvar table in runtime memory.</li>
<li>Remove post-process-pe on &#x27;make clean&#x27;</li>
<li>
<p>pe: missing perror argument</p>
</li>
<li>
<p>CVE-2022-28737: Fixed a buffer overflow when SizeOfRawData > VirtualSize (bsc#1198458)</p>
</li>
<li>
<p>Add mokutil command to post script for setting sbat policy to latest mode
  when the SbatPolicy-605dab50-e046-4300-abb6-3dd810dd8b23 is not created.
  (bsc#1198458)</p>
</li>
<li>
<p>Updated vendor dbx binary and script (bsc#1198458)</p>
</li>
<li>
<p>Updated dbx-cert.tar.xz and vendor-dbx-sles.bin for adding
    SLES-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.</p>
</li>
<li>Updated dbx-cert.tar.xz and vendor-dbx-opensuse.bin for adding
    openSUSE-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.</li>
<li>Updated vendor-dbx.bin for adding SLES-UEFI-SIGN-Certificate-2021-05.crt
    and openSUSE-UEFI-SIGN-Certificate-2021-05.crt for testing environment.</li>
<li>
<p>Updated generate-vendor-dbx.sh script for generating a vendor-dbx.bin
    file which includes all .der for testing environment.</p>
</li>
<li>
<p>avoid buffer overflow when copying data to the MOK config table (bsc#1185232)</p>
</li>
<li>Disable exporting vendor-dbx to MokListXRT since writing a large RT variable could crash some machines (bsc#1185261)</li>
<li>ignore the odd LoadOptions length (bsc#1185232)</li>
<li>shim-install: reset def_shim_efi to "shim.efi" if the given file doesn&#x27;t exist</li>
<li>relax the maximum variable size check for u-boot (bsc#1185621)</li>
<li>
<p>handle ignore_db and user_insecure_mode correctly (bsc#1185441, bsc#1187071)</p>
</li>
<li>
<p>Split the keys in vendor-dbx.bin to vendor-dbx-sles and
  vendor-dbx-opensuse for shim-sles and shim-opensuse to reduce
  the size of MokListXRT (bsc#1185261) </p>
</li>
<li>Also update generate-vendor-dbx.sh in dbx-cert.tar.xz</li>
</ul>



    

    <h2>Patch Instructions:</h2>
    <p>
        To install this SUSE  update use the SUSE recommended
        installation methods like YaST online_update or "zypper patch".<br/>

        Alternatively you can run the command listed for your product:
    </p>
    <ul class="list-group">
        
            <li class="list-group-item">
                SUSE OpenStack Cloud 9
                
                    
                        <br/>
                        <code>zypper in -t patch SUSE-OpenStack-Cloud-9-2023-1863=1</code>
                    
                    
                
            </li>
        
            <li class="list-group-item">
                SUSE OpenStack Cloud Crowbar 9
                
                    
                        <br/>
                        <code>zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2023-1863=1</code>
                    
                    
                
            </li>
        
            <li class="list-group-item">
                SUSE Linux Enterprise Server for SAP Applications 12 SP4
                
                    
                        <br/>
                        <code>zypper in -t patch SUSE-SLE-SAP-12-SP4-2023-1863=1</code>
                    
                    
                
            </li>
        
            <li class="list-group-item">
                SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4
                
                    
                        <br/>
                        <code>zypper in -t patch SUSE-SLE-SERVER-12-SP4-ESPOS-2023-1863=1</code>
                    
                    
                
            </li>
        
            <li class="list-group-item">
                SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4
                
                    
                        <br/>
                        <code>zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2023-1863=1</code>
                    
                    
                
            </li>
        
            <li class="list-group-item">
                SUSE Linux Enterprise Server for SAP Applications 12 SP5
                
                    
                        <br/>
                        <code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-1863=1</code>
                    
                    
                
            </li>
        
            <li class="list-group-item">
                SUSE Linux Enterprise High Performance Computing 12 SP5
                
                    
                        <br/>
                        <code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-1863=1</code>
                    
                    
                
            </li>
        
            <li class="list-group-item">
                SUSE Linux Enterprise Server 12 SP5
                
                    
                        <br/>
                        <code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-1863=1</code>
                    
                    
                
            </li>
        
    </ul>

    <h2>Package List:</h2>
    <ul>
        
            
                <li>
                    SUSE OpenStack Cloud 9 (x86_64)
                    <ul>
                        
                            <li>shim-15.7-25.24.1</li>
                        
                    </ul>
                </li>
            
        
            
                <li>
                    SUSE OpenStack Cloud Crowbar 9 (x86_64)
                    <ul>
                        
                            <li>shim-15.7-25.24.1</li>
                        
                    </ul>
                </li>
            
        
            
                <li>
                    SUSE Linux Enterprise Server for SAP Applications 12 SP4 (x86_64)
                    <ul>
                        
                            <li>shim-15.7-25.24.1</li>
                        
                    </ul>
                </li>
            
        
            
                <li>
                    SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (x86_64)
                    <ul>
                        
                            <li>shim-15.7-25.24.1</li>
                        
                    </ul>
                </li>
            
        
            
                <li>
                    SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (x86_64)
                    <ul>
                        
                            <li>shim-15.7-25.24.1</li>
                        
                    </ul>
                </li>
            
        
            
                <li>
                    SUSE Linux Enterprise Server for SAP Applications 12 SP5 (x86_64)
                    <ul>
                        
                            <li>shim-15.7-25.24.1</li>
                        
                    </ul>
                </li>
            
        
            
                <li>
                    SUSE Linux Enterprise High Performance Computing 12 SP5 (x86_64)
                    <ul>
                        
                            <li>shim-15.7-25.24.1</li>
                        
                    </ul>
                </li>
            
        
            
                <li>
                    SUSE Linux Enterprise Server 12 SP5 (x86_64)
                    <ul>
                        
                            <li>shim-15.7-25.24.1</li>
                        
                    </ul>
                </li>
            
        
    </ul>

    
        <h2>References:</h2>
        <ul>
            
                
                    <li>
                        <a href="https://www.suse.com/security/cve/CVE-2022-28737.html">https://www.suse.com/security/cve/CVE-2022-28737.html</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1185232">https://bugzilla.suse.com/show_bug.cgi?id=1185232</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1185261">https://bugzilla.suse.com/show_bug.cgi?id=1185261</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1185441">https://bugzilla.suse.com/show_bug.cgi?id=1185441</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1185621">https://bugzilla.suse.com/show_bug.cgi?id=1185621</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1187071">https://bugzilla.suse.com/show_bug.cgi?id=1187071</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1187260">https://bugzilla.suse.com/show_bug.cgi?id=1187260</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1193282">https://bugzilla.suse.com/show_bug.cgi?id=1193282</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1193315">https://bugzilla.suse.com/show_bug.cgi?id=1193315</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1198458">https://bugzilla.suse.com/show_bug.cgi?id=1198458</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1201066">https://bugzilla.suse.com/show_bug.cgi?id=1201066</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1202120">https://bugzilla.suse.com/show_bug.cgi?id=1202120</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://bugzilla.suse.com/show_bug.cgi?id=1205588">https://bugzilla.suse.com/show_bug.cgi?id=1205588</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://jira.suse.com/browse/PED-127">https://jira.suse.com/browse/PED-127</a>
                    </li>
                
            
                
                    <li>
                        <a href="https://jira.suse.com/browse/PED-1273">https://jira.suse.com/browse/PED-1273</a>
                    </li>
                
            
        </ul>
    
</div>