There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables. The handle_image() function takes in account by the SizeOfRawData field from each section to be load, an attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2022:5098 https://access.redhat.com/errata/RHSA-2022:5098
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2022:5096 https://access.redhat.com/errata/RHSA-2022:5096
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:5099 https://access.redhat.com/errata/RHSA-2022:5099
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:5095 https://access.redhat.com/errata/RHSA-2022:5095
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2022:5100 https://access.redhat.com/errata/RHSA-2022:5100
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-28737