CVE-2023-48733
edk2: An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2
CVE-2023-48733 is fixed in 12 products on 1 platform, first by ovmf 0~20191122.bd85bf54-2ubuntu3.5, released February 13, 2024. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
6.7
medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0026
17th percentile
An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| edk2 · Debian 11.6 (bullseye) | 2020.11-2+deb11u2 | DSA-5624-1 | Feb 14, 2024 |
| edk2 · Debian 12.15 (bookworm) | 2022.11-6+deb12u1 | DSA-5624-1 | Feb 14, 2024 |
| edk2 · Debian 13.5 (trixie) | 2023.11-7 | DEBIAN-CVE-2023-48733 | Feb 14, 2024 |
| edk2 · Debian 14 | 2023.11-7 | DEBIAN-CVE-2023-48733 | Feb 14, 2024 |
| efi-shell-aa64 · Ubuntu 24.10 (oracular) | 2023.11-7 | efi-shell-aa64 2023.11-7 | Feb 14, 2024 |
| efi-shell-aa64 · Ubuntu 25.04 (plucky) | 2023.11-7 | efi-shell-aa64 2023.11-7 | Feb 14, 2024 |
| efi-shell-arm · Ubuntu 24.10 (oracular) | 2023.11-7 | efi-shell-arm 2023.11-7 | Feb 14, 2024 |
| efi-shell-arm · Ubuntu 25.04 (plucky) | 2023.11-7 | efi-shell-arm 2023.11-7 | Feb 14, 2024 |
| efi-shell-ia32 · Ubuntu 24.10 (oracular) | 2023.11-7 | efi-shell-ia32 2023.11-7 | Feb 14, 2024 |
| efi-shell-ia32 · Ubuntu 25.04 (plucky) | 2023.11-7 | efi-shell-ia32 2023.11-7 | Feb 14, 2024 |
| efi-shell-riscv64 · Ubuntu 24.10 (oracular) | 2023.11-7 | efi-shell-riscv64 2023.11-7 | Feb 14, 2024 |
| efi-shell-riscv64 · Ubuntu 25.04 (plucky) | 2023.11-7 | efi-shell-riscv64 2023.11-7 | Feb 14, 2024 |
| efi-shell-x64 · Ubuntu 24.10 (oracular) | 2023.11-7 | efi-shell-x64 2023.11-7 | Feb 14, 2024 |
| efi-shell-x64 · Ubuntu 25.04 (plucky) | 2023.11-7 | efi-shell-x64 2023.11-7 | Feb 14, 2024 |
| ovmf · Ubuntu 20.04 LTS (focal) | 0~20191122.bd85bf54-2ubuntu3.5 | ovmf 0~20191122.bd85bf54-2ubuntu3.5 | Feb 13, 2024 |
| ovmf · Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.2 | ovmf 2022.02-3ubuntu0.22.04.2 | Feb 13, 2024 |
| ovmf · Ubuntu 24.10 (oracular) | 2023.11-7 | ovmf 2023.11-7 | Feb 14, 2024 |
| ovmf · Ubuntu 25.04 (plucky) | 2023.11-7 | ovmf 2023.11-7 | Feb 14, 2024 |
| ovmf-ia32 · Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.2 | ovmf-ia32 2022.02-3ubuntu0.22.04.2 | Feb 13, 2024 |
| ovmf-ia32 · Ubuntu 24.10 (oracular) | 2023.11-7 | ovmf-ia32 2023.11-7 | Feb 14, 2024 |
| ovmf-ia32 · Ubuntu 25.04 (plucky) | 2023.11-7 | ovmf-ia32 2023.11-7 | Feb 14, 2024 |
| qemu-efi · Ubuntu 20.04 LTS (focal) | 0~20191122.bd85bf54-2ubuntu3.5 | qemu-efi 0~20191122.bd85bf54-2ubuntu3.5 | Feb 13, 2024 |
| qemu-efi · Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.2 | qemu-efi 2022.02-3ubuntu0.22.04.2 | Feb 13, 2024 |
| qemu-efi-aarch64 · Ubuntu 20.04 LTS (focal) | 0~20191122.bd85bf54-2ubuntu3.5 | qemu-efi-aarch64 0~20191122.bd85bf54-2ubuntu3.5 | Feb 13, 2024 |
| qemu-efi-aarch64 · Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.2 | qemu-efi-aarch64 2022.02-3ubuntu0.22.04.2 | Feb 13, 2024 |
| qemu-efi-aarch64 · Ubuntu 24.10 (oracular) | 2023.11-7 | qemu-efi-aarch64 2023.11-7 | Feb 14, 2024 |
| qemu-efi-aarch64 · Ubuntu 25.04 (plucky) | 2023.11-7 | qemu-efi-aarch64 2023.11-7 | Feb 14, 2024 |
| qemu-efi-arm · Ubuntu 20.04 LTS (focal) | 0~20191122.bd85bf54-2ubuntu3.5 | qemu-efi-arm 0~20191122.bd85bf54-2ubuntu3.5 | Feb 13, 2024 |
| qemu-efi-arm · Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.2 | qemu-efi-arm 2022.02-3ubuntu0.22.04.2 | Feb 13, 2024 |
| qemu-efi-arm · Ubuntu 24.10 (oracular) | 2023.11-7 | qemu-efi-arm 2023.11-7 | Feb 14, 2024 |
| qemu-efi-arm · Ubuntu 25.04 (plucky) | 2023.11-7 | qemu-efi-arm 2023.11-7 | Feb 14, 2024 |
| qemu-efi-riscv64 · Ubuntu 24.10 (oracular) | 2023.11-7 | qemu-efi-riscv64 2023.11-7 | Feb 14, 2024 |
| qemu-efi-riscv64 · Ubuntu 25.04 (plucky) | 2023.11-7 | qemu-efi-riscv64 2023.11-7 | Feb 14, 2024 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.