Vulnerability · Published Feb 14, 2024 · Assigned by canonical
CVE-2023-49721
Medium 6.7
In plain English
A medium-severity incorrect default permissions in LXD from Canonical Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)6.7Medium
Exploit odds (30 days)0.2%top 85.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Canonical Ltd. | LXD | 0 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/2040139 issue-tracking
- https://nvd.nist.gov/vuln/detail/CVE-2023-48733 issue-tracking
- https://www.openwall.com/lists/oss-security/2024/02/14/4 mailing-list
- https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137 issue-tracking