Description

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.9",
  "pubDate": "2026-08-10T21:17:23.060Z",
  "pubdate": "2026-08-10T21:17:23.060Z",
  "executiveSummary": "An unhandled NULL pointer vulnerability has been identified within the shim application of the dp.c library. This security defect introduces a significant risk to systems utilizing the shim application as part of the UEFI bootloader chain.\nThe primary impact of this vulnerability is a denial of service condition, which can destabilize or halt the system during the boot process. The vulnerability manifests when the application encounters an unexpected state or missing data structure, leading to a dereference of an uninitialized or null memory pointer.\nAttacker capabilities are focused primarily on causing system availability disruptions rather than arbitrary code execution or privilege escalation. Exploitation typically requires an environment or input sequence that triggers the missing validation within the UEFI boot sequence.\nGiven that the vulnerability resides within a critical bootloader component, successful exploitation prevents the affected operating system from booting successfully, rendering the host system inaccessible until physical or administrative intervention is performed.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and missing error handling within the dp.c library of the shim application. Specifically, the code attempts to dereference a pointer without verifying whether it has been successfully allocated or initialized, resulting in a classic NULL pointer dereference condition.\nThe vulnerable component is the dp.c source file within the UEFI shim bootloader framework. When the application processes specific data structures during device path parsing or initialization routines, the absence of a null check causes the execution flow to fault immediately upon encountering a zero-value pointer.\nThe exploitation method relies on supplying or encountering conditions during the UEFI boot phase that cause the targeted function within dp.c to receive or generate a NULL pointer. As the UEFI bootloader executes with high privileges very early in the system startup lifecycle, any unhandled exception or critical fault at this stage halts execution completely.\nThe attack flow proceeds as follows: First, the system initiates the UEFI boot process, loading the vulnerable shim application. Second, the execution reaches the affected routines within the dp.c library where device paths or related configurations are evaluated. Third, due to the missing NULL pointer check, the application attempts to access memory address zero. Finally, the processor triggers a fatal exception, causing an immediate kernel panic, firmware crash, or system reboot loop, thereby achieving a denial of service.\nThe vulnerability affects systems utilizing the vulnerable version of the shim application and dp.c library. Network exposure is generally indirect or dependent on local/physical access or pre-boot environment manipulation, depending on how the boot entries or variables are configured and accessed."
}