Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

CVE-2023-40547

Shim: rce in http boot support may lead to secure boot bypass

HIGH 8.3

At a glance

Source
NVD
EPSS
EPSS 5.42 % · percentile 93 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Modified

Description

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.

Weaknesses (CWE)

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 8.3CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hredhat
CVSS 3.1HIGH 8.3CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HNVD · secalert@redhat.com (Secondary)
CVSS 3.1HIGH 8.3CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Red Hat · Red Hat Enterprise Linux 7unaffected 0:15.8-3.el7 < *
Red Hat · Red Hat Enterprise Linux 7unaffected 0:15.8-1.el7 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:15.8-4.el8_9 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 0:15.8-2.el8_2 < *
Red Hat · Red Hat Enterprise Linux 8.2 Telecommunications Update Serviceunaffected 0:15.8-2.el8_2 < *
Red Hat · Red Hat Enterprise Linux 8.2 Update Services for SAP Solutionsunaffected 0:15.8-2.el8_2 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 0:15.8-2.el8_4 < *
Red Hat · Red Hat Enterprise Linux 8.4 Telecommunications Update Serviceunaffected 0:15.8-2.el8_4 < *
Red Hat · Red Hat Enterprise Linux 8.4 Update Services for SAP Solutionsunaffected 0:15.8-2.el8_4 < *
Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Supportunaffected 0:15.8-2.el8_6 < *
Red Hat · Red Hat Enterprise Linux 8.8 Extended Update Supportunaffected 0:15.8-2.el8 < *
Red Hat · Red Hat Enterprise Linux 8.8 Extended Update Supportunaffected 0:15.8-2.el8 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:15.8-4.el9_3 < *
Red Hat · Red Hat Enterprise Linux 9.0 Extended Update Supportunaffected 0:15.8-3.el9 < *
Red Hat · Red Hat Enterprise Linux 9.0 Extended Update Supportunaffected 0:15.8-2.el9 < *
Red Hat · Red Hat Enterprise Linux 9.0 Extended Update Supportunaffected 0:15.8-2.el9 < *
Red Hat · Red Hat Enterprise Linux 9.2 Extended Update Supportunaffected 0:15.8-3.el9_2 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD