CVE-2022-28737: Red Hat Shim RCE Vulnerability

CVE-2022-28737 Overview

CVE-2022-28737 is an out-of-bounds write vulnerability in Red Hat Shim's handle_image() function that occurs when processing crafted EFI executables. The vulnerability stems from improper handling of the SizeOfRawData field from PE sections during image loading, allowing attackers to perform out-of-bounds memory writes. This can potentially lead to arbitrary code execution during the boot process, representing a significant threat to Secure Boot implementations.

Critical Impact

This vulnerability allows local attackers to potentially execute arbitrary code during the boot process by exploiting an overflow in the shim bootloader's image handling function, potentially bypassing Secure Boot protections.

Affected Products

• Red Hat Shim (all affected versions)
• Linux distributions using vulnerable shim packages
• Systems relying on Secure Boot with affected shim implementations

Discovery Timeline

• July 20, 2023 - CVE-2022-28737 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-28737

Vulnerability Analysis

The vulnerability resides in the handle_image() function within Red Hat Shim, which is responsible for loading and executing EFI executables during the Secure Boot process. The function processes PE (Portable Executable) section headers and uses the SizeOfRawData field to determine how much data to load from each section.

The root cause is classified as CWE-787 (Out-of-bounds Write), where insufficient validation of the SizeOfRawData field allows an attacker to craft a malicious EFI executable with manipulated section sizes. When shim attempts to load such an executable, it can write data beyond the allocated buffer boundaries, corrupting adjacent memory regions.

This vulnerability requires local access and user interaction (such as booting from a malicious device), but does not require elevated privileges to exploit. Successful exploitation can compromise the confidentiality, integrity, and availability of the affected system by allowing code execution at the bootloader level—before the operating system's security controls are initialized.

Root Cause

The vulnerability originates from insufficient bounds checking in the handle_image() function when processing the SizeOfRawData field from PE section headers. The function trusts the size values provided in the crafted EFI executable without properly validating them against the actual image size or available memory, leading to an out-of-bounds write condition. This is a classic integer overflow or improper size validation issue that allows memory corruption during the image loading process.

Attack Vector

The attack requires local access to the target system, typically through physical access to boot media or the ability to modify boot files. An attacker would:

1. Craft a malicious EFI executable with manipulated SizeOfRawData values in the PE section headers
2. Deliver the malicious executable to the target system (via USB boot device, compromised boot partition, or network boot)
3. Trigger the shim bootloader to load and process the crafted executable
4. Exploit the out-of-bounds write to corrupt memory and potentially execute arbitrary code

The vulnerability is particularly dangerous because it occurs during the boot process, before traditional operating system security mechanisms are active. Successful exploitation could allow an attacker to bypass Secure Boot protections and establish persistent access to the system.

Detection Methods for CVE-2022-28737

Indicators of Compromise

• Unexpected or modified EFI executables in the EFI System Partition (ESP)
• Boot failures or abnormal behavior during the Secure Boot process
• Unexpected shim or bootloader binaries with mismatched signatures
• Evidence of tampering with boot partition files

Detection Strategies

• Monitor the EFI System Partition for unauthorized modifications to shim and bootloader files
• Implement file integrity monitoring on all boot-related executables
• Verify that installed shim packages match expected hashes from vendor repositories
• Review system boot logs for anomalies or unexpected behavior during early boot stages

Monitoring Recommendations

• Enable Secure Boot logging and audit trail capabilities where available
• Implement endpoint detection and response (EDR) solutions that can monitor boot integrity
• Regularly audit boot partition contents against known-good baselines
• Deploy hardware-backed attestation mechanisms where supported to verify boot integrity

How to Mitigate CVE-2022-28737

Immediate Actions Required

• Update Red Hat Shim packages to the latest patched versions available from your distribution
• Verify Secure Boot is properly configured and DBX (Forbidden Signature Database) is updated
• Audit the EFI System Partition for any suspicious or unauthorized executables
• Restrict physical access to systems and control boot device ordering in UEFI settings

Patch Information

Organizations should apply the latest security updates for Red Hat Shim from their Linux distribution vendor. The vulnerability was disclosed via the OpenWall OSS-Security mailing list with coordinated updates. Ensure that your system's DBX (UEFI Forbidden Signature Database) is updated to revoke vulnerable shim versions. Consult your distribution's security advisory for specific package versions that address this vulnerability.

Workarounds

• If patching is not immediately possible, restrict boot device ordering in UEFI settings to prevent booting from untrusted media
• Enable UEFI password protection to prevent unauthorized changes to boot configuration
• Implement physical security controls to limit access to system boot media
• Consider temporarily disabling network boot (PXE) if not required, to reduce attack surface

# Verify shim package version on Red Hat-based systems
rpm -qa | grep shim

# Check the EFI System Partition for suspicious files
ls -la /boot/efi/EFI/

# Verify Secure Boot status
mokutil --sb-state

# Update shim packages (Red Hat/Fedora)
sudo dnf update shim-*