medium6.7
CVE-2023-49721
An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD.
Impact
An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Canonical | Lxd | from 5.0.0 before 5.21.0 |
| Tianocore | Edk2 | through 2023.11-8 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137
- https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/2040139
- https://nvd.nist.gov/vuln/detail/CVE-2023-48733
- https://www.openwall.com/lists/oss-security/2024/02/14/4
- https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137
- https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/2040139
- https://nvd.nist.gov/vuln/detail/CVE-2023-48733
- https://www.openwall.com/lists/oss-security/2024/02/14/4