The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9465 advisory.

    [15.6-1.0.3]
    - Update shimx64.efi and shimia32.efi signed by Microsoft [JIRA: OLDIS-16370]

    [15.6-1.0.2]
    - Update to shim-unsigned v15.6.rc2 [JIRA: OLDIS-16370]

    [15.6-1.0.1]
    - Update to shim-unsigned v15.6.rc1 [JIRA: OLDIS-16370]

    [15.5-1.0.3]
    - Update vendor certs [JIRA: OLDIS-16370]
    - Update oracle(grub2-sig-key) [JIRA: OLDIS-16370]

    [15.5-1.0.1]
    - Allow MokListTrusted to be enabled by default [Orabug: 33770149]
    - Add patchset to load additional certificates from vendor signed EFI binary [Orabug: 33770149]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1368-1 advisory.

    - Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)
    - Limit the requirement of fde-tpm-helper-macros to the distro with       suse_version 1600 and above (bsc#1219460)

    Update to version 15.8:

    Security issues fixed:

    - mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)
    - avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)
    - Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)
    - Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)
    - pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)
    - pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)


    The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by     this patch now.

    - Generate dbx during build so we don't include binary files in sources
    - Don't require grub so shim can still be used with systemd-boot
    - Update shim-install to fix boot failure of ext4 root file system       on RAID10 (bsc#1205855)
    - Adopt the macros from fde-tpm-helper-macros to update the       signature in the sealed key after a bootloader upgrade

    - Update shim-install to amend full disk encryption support
      - Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector
      - Use the long name to specify the grub2 key protector
      - cryptodisk: support TPM authorized policies
      - Do not use tpm_record_pcrs unless the command is in command.lst

    - Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to       enable the NX compatibility flag when using post-process-pe after       discussed with grub2 experts in mail. It's useful for further development       and testing. (bsc#1205588)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1461-1 advisory.

    - Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)
    - Limit the requirement of fde-tpm-helper-macros to the distro with       suse_version 1600 and above (bsc#1219460)

    Update to version 15.8:

    Security issues fixed:

    - mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)
    - avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)
    - Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)
    - Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)
    - pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)
    - pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)


    The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by     this patch now.

    - Generate dbx during build so we don't include binary files in sources
    - Don't require grub so shim can still be used with systemd-boot
    - Update shim-install to fix boot failure of ext4 root file system       on RAID10 (bsc#1205855)
    - Adopt the macros from fde-tpm-helper-macros to update the       signature in the sealed key after a bootloader upgrade

    - Update shim-install to amend full disk encryption support
      - Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector
      - Use the long name to specify the grub2 key protector
      - cryptodisk: support TPM authorized policies
      - Do not use tpm_record_pcrs unless the command is in command.lst

    - Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to       enable the NX compatibility flag when using post-process-pe after       discussed with grub2 experts in mail. It's useful for further development       and testing. (bsc#1205588)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5099 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot     loader under secure boot environments.

    Security Fix(es):

    * grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)

    * grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)

    * grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)

    * grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)

    * grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)

    * grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)

    * grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)

    * shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5098 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot     loader under secure boot environments.

    Security Fix(es):

    * grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)

    * grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)

    * grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)

    * grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)

    * grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)

    * grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)

    * grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)

    * shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5095 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot     loader under secure boot environments.

    Security Fix(es):

    * grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)

    * grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)

    * grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)

    * grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)

    * grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)

    * grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)

    * grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)

    * shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5095 advisory.

  - A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may     lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be     considered Low as it's very complex to an attacker control the encoding and positioning of corrupted     Huffman entries to achieve results such as arbitrary code execution and/or secure boot circumvention. This     flaw affects grub2 versions prior grub-2.12. (CVE-2021-3696)

  - A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may     take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent     secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform     some triage over the heap layout to achieve signifcant results, also the values written into the memory     are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2     versions prior grub-2.12. (CVE-2021-3695)

  - A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data     to be written in heap. To a successful to be performed the attacker needs to perform some triage over the     heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data     corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions     prior grub-2.12. (CVE-2021-3697)

  - Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer     underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the     total_len value may end up wrapping around to a small integer number which will be used in memory     allocation. If the attack succeeds in such way, subsequent operations can write past the end of the     buffer. (CVE-2022-28733)

  - Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code     accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write     further when parsing the HTTP request, writing a NULL byte past the buffer. It's conceivable that an     attacker controlled set of packets can lead to corruption of the GRUB2's internal memory metadata.
    (CVE-2022-28734)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0134 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-3695:
    A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may     take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent     secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform     some triage over the heap layout to achieve signifcant results, also the values written into the memory     are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2     versions prior grub-2.12.

    CVE-2021-3696:
    A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may     lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be     considered Low as it's very complex to an attacker control the encoding and positioning of corrupted     Huffman entries to achieve results such as arbitrary code execution and/or secure boot circumvention. This     flaw affects grub2 versions prior grub-2.12.

    CVE-2021-3697:
    A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data     to be written in heap. To a successful to be performed the attacker needs to perform some triage over the     heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data     corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions     prior grub-2.12.

    CVE-2022-28733:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2022-28734:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2022-28735:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2022-28736:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2021-3981:
    A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong     permission set allowing non privileged users to read its content. This represents a low severity     confidentiality issue, as those users can eventually read any encrypted passwords present in grub.cfg.
    This flaw affects grub2 2.06 and previous versions. This issue has been fixed in grub upstream but no     version with the fix is currently released.

    CVE-2022-28737:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4042:01 advisory.

    * grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)
      * grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)
      * grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)
      * grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)
      * grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)
      * grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)
      * grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)
      * shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
161939	Oracle Linux 8 : shim (ELSA-2022-9465)	Nessus	Oracle Linux Local Security Checks	6/8/2022	10/22/2024	high
193725	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : shim (SUSE-SU-2024:1368-1)	Nessus	SuSE Local Security Checks	4/23/2024	6/25/2026	high
194744	SUSE SLES15 Security Update : shim (SUSE-SU-2024:1461-1)	Nessus	SuSE Local Security Checks	4/30/2024	6/25/2026	high
162325	RHEL 9 : grub2, mokutil, shim, and shim-unsigned-x64 (RHSA-2022:5099)	Nessus	Red Hat Local Security Checks	6/16/2022	11/7/2024	high
162327	RHEL 8 : grub2, mokutil, and shim (RHSA-2022:5098)	Nessus	Red Hat Local Security Checks	6/16/2022	11/7/2024	high
162329	RHEL 8 : grub2, mokutil, shim, and shim-unsigned-x64 (RHSA-2022:5095)	Nessus	Red Hat Local Security Checks	6/16/2022	11/7/2024	high
162843	Rocky Linux 8 : grub2, mokutil, shim, and shim-unsigned-x64 (RLSA-2022:5095)	Nessus	Rocky Linux Local Security Checks	7/8/2022	1/18/2024	high
236599	Alibaba Cloud Linux 3 : 0134: grub2, mokutil, shim, and shim-unsigned-x64 (ALINUX3-SA-2022:0134)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	high
292017	MiracleLinux 8 : grub2-2.02-123.el8.8.ML.1, mokutil-0.3.0-11.el8.1, shim-15.6-1.el8.ML.1, shim-unsigned-x64-15.6-1.el8.ML.1 (AXSA:2022-4042:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high