News for hackers. Stuff that matters.

A comment on CVE-2023-40547 – avoid incorrectly trusting HTTP headers. Parent comment

Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by RcouF1uZ4gsC on Thursday January 25, 2024 @03:53PM (#39135129)
> When you tell shim what EFI binary to boot, you can specify it as an HTTP URL. If you do this and the HTTP server is malicious, it can trigger an out-of-bounds write.

Can a malicious server just send a compromised binary directly?

[ Parent | on HN ]
Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by smileybarry on Thursday January 25, 2024 @07:52PM (#39137605)
No, because that binary is still sigchecked against the locally-accepted keys (MOK). But an out-of-bounds write can be abused to bypass that.
[ Parent | on HN ]