Log in Start free

Vulnerability · Published Jan 25, 2024 · Assigned by redhat

CVE-2023-40547Shim: rce in http boot support may lead to secure boot bypass

High 8.3

In plain English

A high-severity out-of-bounds write in Red Hat Enterprise Linux 7 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.4% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.3High
Exploit odds (30 days)5.4%top 7.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8shim-aa6415.8-4.el8_9.alma.1ALSA-2024:1902
AlmaLinux:9shim-aa6415.8-4.el9_3.alma.1ALSA-2024:1903
AlmaLinux:8shim-ia3215.8-4.el8_9.alma.1ALSA-2024:1902
AlmaLinux:8shim-x6415.8-4.el8_9.alma.1ALSA-2024:1902
AlmaLinux:9shim-x6415.8-4.el9_3.alma.1ALSA-2024:1903
Debian:12shim15.8-1~deb12u1DEBIAN-CVE-2023-40547
Debian:13shim15.8-1DEBIAN-CVE-2023-40547
Debian:14shim15.8-1DEBIAN-CVE-2023-40547
Ubuntu:22.04:LTSshim15.8-0ubuntu1UBUNTU-CVE-2023-40547
Ubuntu:24.04:LTSshim15.8-0ubuntu1UBUNTU-CVE-2023-40547
Ubuntu:22.04:LTSshim-signed1.51.4UBUNTU-CVE-2023-40547
Ubuntu:24.04:LTSshim-signed1.58UBUNTU-CVE-2023-40547

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support see references
Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References