Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged
Permalink CVE-2023-40548
7.4 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 10 months, 2 weeks ago
Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems

A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.

References

Affected products

shim
  • ==15.8
  • ==15.8-1.el7
  • *
shim-signed
  • *
shim-unsigned-x64
  • *
shim-unsigned-aarch64
  • *

Matching in nixpkgs

pkgs.yoshimi

High quality software synthesizer based on ZynAddSubFX

pkgs.libudev0-shim

Shim to preserve libudev.so.0 compatibility

  • nixos-unstable 1
    • nixpkgs-unstable 1
    • nixos-unstable-small 1

pkgs.plex-mpv-shim

Allows casting of videos to MPV via the Plex mobile and web app

pkgs.jellyfin-mpv-shim

Allows casting of videos to MPV via the jellyfin mobile and web app

Package maintainers