← Back

CVE-2023-48733

nvd nist
Published: Feb 14, 2024Modified: Jun 17, 2026

JSON object

Loading...
6.7
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 0.8 / Impact: 5.9
Source: security@ubuntu.com (Secondary)

Description

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.

Affected (5)

Canonical
1 product
Lxd
Tianocore
1 product
Edk2
Debian
1 product
Debian Linux
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Canonical
Lxd
Version 5.0 candidate
Lxd
Version 5.21 candidate
Lxd
Version 5.21 edge
Edk2
Up to 2023.11-8
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 10.0

Related CWEs

CWE-1188
Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

References (10)

Source: security@ubuntu.com
Issue Tracking
Source: security@ubuntu.com
Issue Tracking
Source: security@ubuntu.com
Mailing List
Source: security@ubuntu.com
Third Party Advisory
Source: security@ubuntu.com
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List

Timeline

No history available yet.