The maintainers of shim at RedHat have patched a critical vulnerability that could have let an attacker gain privileged access to a Linux system even before the kernel was loaded, potentially leading to a complete system takeover.
When working properly, a shim functions as an early stage bootloader that’s primarily used to let Linux distributions support the Secure Boot process. It’s signed with Microsoft's Third-Party Certificate Authority, which lets the shim become a valid participant in a Secure Boot as configured on most computers.
The critical vulnerability — CVE-2023-40547 — was especially concerning to security pros because it potentially lets an attacker gain pre-operating system control of a system and bypass the security protections enforced by Secure Boot. Through several different attack paths, an attacker could leverage the flaw to disrupt or gain control of the entire boot process.
“In some cases, a system must have a vulnerable version of shim installed, in other use cases, an attacker may install a vulnerable version of shim to bypass Secure Boot and manipulate the kernel and operating system, typically to disable security controls that would otherwise be difficult to disable once the system has fully booted,” explained Paul Asadoorian, principal security evangelist for Eclypsium and host of Paul's Security Weekly.
Bill Demirkapi of the Microsoft Security Response Center (MSRC) was credited with discovering and reporting the bug, which was fully detailed in a Feb. 6 Eclypsium blog.
The Eclypsium blog pointed out that the bug affects all Linux systems that run Secure Boot, whether a server or end user system. While at first blush security pros may think the bug only affects RedHat systems, the researchers said several other Linux distributions were applying the patches, including Debian, Ubunu, and SUSE. Along with the critical bug identified, there were also five other medium-severity flaws in shim.
“Given that the Linux landscape is widely used for servers in businesses, it's crucial to emphasize the importance of patching this issue,” said Ashwin Vamshi, principal security researcher at Menlo Security. “This vulnerability affects every Linux bootloader signed in the past decade.”
John Gallagher, vice president of Viakoo Labs, added that this was a very serious threat because of how exploitable the vulnerability is across a large number of device and system types. Gallagher said threat actors aim at the weakest part of an organization’s defenses and the parts that take a long time to remediate, and that’s exactly what the shim vulnerability presents.
“This shim vulnerability is particularly difficult to mitigate and remediate because they are in the earliest stage of software and hardware interactions,” explained Gallagher. “This stage of system initialization also provides root access to a variety of services, which makes the overall attack surface quite large.”
Gallagher said Linux is used in many non-IT systems, such as IoT and OT, where it’s harder to find and remediate this vulnerability. Unlike traditional IT systems where there are multiple layers of security that can help mitigate the impact of the vulnerability, Gallagher said many IoT and OT systems using Linux that are infected by this shim vulnerability will remain infected and undetected. Organizations with large IoT/OT deployments should be particularly concerned, and should ensure they have application-based IoT discovery, as well as an automated remediation solution for firmware updates, said Gallagher.
Adam Neel, threat detection engineer at Critical Start, pointed out that while the vulnerability has not been exploited in the wild yet, Linux administrators should prioritize patching to the newest shim version as soon as possible.
“The potential for damage is significant,” said Neel. “It allows attackers to circumvent endpoint protections and install a bootkit, giving malicious actors a serious boost in privileges, and potentially full control of a system. This exploit happens at such a low level in the system and so early in the boot process that there is no way to detect that CVE-2023-40547 has been exploited by standard means until it is too late."
