CVE-2023-48733: An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2

Medium severity · published Feb 14, 2024

CVE-2023-48733

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2

6.7

CVSS

0.3%

EPSS

On KEV

Description

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 17% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Debian Linux · Debian

10.0 · source: NVD

Edk2 · Tianocore

through 2023.11-8 · source: NVD

Lxd · Canonical

5.0; 5.21; 5.21 · source: NVD

Affected product

Lxd

Canonical

All Lxd CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-48733

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-48733

Issue Tracking

https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137

Issue Tracking

https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/2040139

Mailing List

https://lists.debian.org/debian-lts-announce/2024/06/msg00028.html

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-48733

Mailing List

https://www.openwall.com/lists/oss-security/2024/02/14/4