Read the docs
TI-2023-21351 Aliases CVE-2023-40546GHSA-9fh5-955w-9jfh

Shim: out-of-bounds read printing error messages

Priority LOW 28CWE-476Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00438 38th percentileScored 2026-11-07
Fix Fixed Red Hat: 9 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Enterprise Linux 7—15.8-3.el7Patch availableCNA
Red HatRed Hat Enterprise Linux 7—15.8-1.el7Patch availableCNA
Red HatRed Hat Enterprise Linux 8—15.8-4.el8_9Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—15.8-2.el8_2Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Telecommunications Update Service—15.8-2.el8_2Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Update Services for SAP Solutions—15.8-2.el8_2Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—15.8-2.el8_4Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service—15.8-2.el8_4Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions—15.8-2.el8_4Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support—15.8-2.el8_6Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—15.8-2.el8Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—15.8-2.el8Patch availableCNA
Red HatRed Hat Enterprise Linux 9—15.8-4.el9_3Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—15.8-3.el9Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—15.8-2.el9Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—15.8-2.el9Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—15.8-3.el9_2Patch availableCNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 15.8-3.el7 Patch available CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 15.8-1.el7 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 15.8-4.el8_9 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8_2 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Telecommunications Update Service VendorRed Hat Affected — Fixed in 15.8-2.el8_2 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 15.8-2.el8_2 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8_4 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Telecommunications Update Service VendorRed Hat Affected — Fixed in 15.8-2.el8_4 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 15.8-2.el8_4 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8_6 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 15.8-4.el9_3 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-3.el9 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el9 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el9 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-3.el9_2 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:redhat:shim:*:*:*:*:*:*:*:*before 15.8VulnerableRed Hat
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39VulnerableFedoraproject
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
  • cpe:2.3:a:redhat:shim:*:*:*:*:*:*:*:* Versions before 15.8 Vulnerable ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat

Remediation

Red Hat 9 advisories

  • RHSA-2024:2086 Released 2024-04-29 · Red Hat rating Important
    shim security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.6) shim-15.8-2.el8_6, shim-aa64-15.8-2.el8_6, shim-ia32-15.8-2.el8_6 +1
  • RHSA-2024:1959 Released 2024-04-23 · Red Hat rating Important
    shim security update
    • Red Hat Enterprise Linux Client (v. 7) mokutil-15.8-1.el7, shim-15.8-3.el7, shim-ia32-15.8-1.el7 +4
    • Red Hat Enterprise Linux Server (v. 7) mokutil-15.8-1.el7, shim-15.8-3.el7, shim-ia32-15.8-1.el7 +4
    • Red Hat Enterprise Linux Workstation (v. 7) mokutil-15.8-1.el7, shim-15.8-3.el7, shim-ia32-15.8-1.el7 +4
  • RHSA-2024:1902 Released 2024-04-18 · Red Hat rating Important
    shim security update
    • Red Hat Enterprise Linux BaseOS (v. 8) shim-15.8-4.el8_9, shim-aa64-15.8-4.el8_9, shim-ia32-15.8-4.el8_9 +1
Show 6 more Red Hat advisories
  • RHSA-2024:1903 Released 2024-04-18 · Red Hat rating Important
    shim bug fix update
    • Red Hat Enterprise Linux BaseOS (v. 9) shim-15.8-4.el9_3, shim-aa64-15.8-4.el9_3, shim-x64-15.8-4.el9_3
  • RHSA-2024:1883 Released 2024-04-18 · Red Hat rating Important
    shim security update
    • Red Hat CodeReady Linux Builder EUS (v.8.8) shim-unsigned-x64-15.8-2.el8
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) shim-15.8-2.el8, shim-aa64-15.8-2.el8, shim-ia32-15.8-2.el8 +1
  • RHSA-2024:1876 Released 2024-04-18 · Red Hat rating Important
    shim bug fix update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.2) shim-15.8-3.el9_2, shim-aa64-15.8-3.el9_2, shim-x64-15.8-3.el9_2
  • RHSA-2024:1873 Released 2024-04-18 · Red Hat rating Important
    shim security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) shim-15.8-2.el8_4, shim-ia32-15.8-2.el8_4, shim-x64-15.8-2.el8_4
    • Red Hat Enterprise Linux BaseOS E4S (v.8.4) shim-15.8-2.el8_4, shim-ia32-15.8-2.el8_4, shim-x64-15.8-2.el8_4
    • Red Hat Enterprise Linux BaseOS TUS (v.8.4) shim-15.8-2.el8_4, shim-ia32-15.8-2.el8_4, shim-x64-15.8-2.el8_4
  • RHSA-2024:1835 Released 2024-04-16 · Red Hat rating Important
    shim security update
    • Red Hat CodeReady Linux Builder EUS (v.9.0) shim-unsigned-x64-15.8-2.el9
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) shim-unsigned-aarch64-15.8-2.el9
    • Red Hat Enterprise Linux BaseOS EUS (v.9.0) shim-15.8-3.el9, shim-aa64-15.8-3.el9, shim-x64-15.8-3.el9
  • RHSA-2024:1834 Released 2024-04-16 · Red Hat rating Important
    shim security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) shim-15.8-2.el8_2, shim-ia32-15.8-2.el8_2, shim-x64-15.8-2.el8_2
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.2) shim-15.8-2.el8_2, shim-ia32-15.8-2.el8_2, shim-x64-15.8-2.el8_2
    • Red Hat Enterprise Linux BaseOS TUS (v. 8.2) shim-15.8-2.el8_2, shim-ia32-15.8-2.el8_2, shim-x64-15.8-2.el8_2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1834

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1835

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
Show 7 more groups
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1873

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1876

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1883

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1902

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1903

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1959

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:2086

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.8.8)Fixed RHSA-2024:1883
Red Hat CodeReady Linux Builder EUS (v.9.0)Fixed RHSA-2024:1835
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2024:1835
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2024:1902
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2024:1903
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2024:1834
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2024:1873
Red Hat Enterprise Linux BaseOS E4S (v. 8.2)Fixed RHSA-2024:1834
Red Hat Enterprise Linux BaseOS E4S (v.8.4)Fixed RHSA-2024:1873
Red Hat Enterprise Linux BaseOS EUS (v.8.6)Fixed RHSA-2024:2086
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2024:1883
Red Hat Enterprise Linux BaseOS EUS (v.9.0)Fixed RHSA-2024:1835
Red Hat Enterprise Linux BaseOS EUS (v.9.2)Fixed RHSA-2024:1876
Red Hat Enterprise Linux BaseOS TUS (v. 8.2)Fixed RHSA-2024:1834
Red Hat Enterprise Linux BaseOS TUS (v.8.4)Fixed RHSA-2024:1873
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2024:1959
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2024:1959
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2024:1959

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-40546
  2. 2026-10-03 Alias added: GHSA-9fh5-955w-9jfh

References

Advisory 11

  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
See all 1955 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences