ALSA-2023:1572 - pesign security update
Summary
ALSA-2023:1572: Important: pesign security update. Affects pesign versions < 0.112-27.el8_7. Fixed in 0.112-27.el8_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pesign packages provide the pesign utility for signing UEFI binaries as well as other associated tools. It is commonly used for signing UEFI binaries to ensure their authenticity and integrity. The pesign utility is an essential component in the UEFI Secure Boot process, which verifies the digital signatures of firmware and bootloader binaries before allowing them to execute. This helps prevent unauthorized or malicious code from running on UEFI-based systems.
Vulnerability Detail
The pesign systemd service is vulnerable to a local privilege escalation vulnerability, identified as CVE-2022-3560. This vulnerability allows an attacker with local access to the system to escalate their privileges and gain root-level access. By exploiting this vulnerability, an attacker can execute arbitrary code with elevated privileges, potentially leading to unauthorized access, data theft, or further compromise of the affected system. The impact of this vulnerability is significant, as it allows an attacker to bypass security controls and gain full control over the system.
How To Fix
Minimum fixed version
0.112-27.el8_7
This is the first release that contains the fix.
sudo dnf update pesignTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to mitigate the risk of exploitation.
Conclusion
The pesign package is vulnerable to a local privilege escalation vulnerability that allows an attacker with local access to the system to gain root-level access. To mitigate this risk, it is crucial to update the pesign package to version 0.112-27.el8_7 or later. This security update addresses the privilege escalation vulnerability and helps ensure the integrity and security of UEFI binaries. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pesign →
FAQ
Pesign is a utility used for signing UEFI binaries and ensuring their authenticity and integrity. It is commonly used in the UEFI Secure Boot process.
The vulnerability allows an attacker with local access to the system to escalate their privileges and gain root-level access. This can lead to unauthorized access, data theft, or further compromise of the affected system.
To fix this vulnerability, update the pesign package to version 0.112-27.el8_7 or later using the package management tools provided by the operating system.
There is no known workaround for this vulnerability. It is crucial to apply the security update as soon as possible.
You can find more information about this vulnerability in the CVE page(s) listed in the References section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for pesign.
