Shim: rce in http boot support may lead to secure boot bypass
Priority MEDIUM 46CWE-787Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787, CWE-346 and the CVSS impact.
Summary
A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05417 92nd percentileScored 2026-11-07
Fix Fixed Red Hat: 9 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 7 | — | 15.8-3.el7 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | 15.8-1.el7 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 15.8-4.el8_9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | 15.8-2.el8_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Telecommunications Update Service | — | 15.8-2.el8_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | — | 15.8-2.el8_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 15.8-2.el8_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | 15.8-2.el8_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | 15.8-2.el8_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | — | 15.8-2.el8_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | 15.8-2.el8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | 15.8-2.el8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 15.8-4.el9_3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | — | 15.8-3.el9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | — | 15.8-2.el9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | — | 15.8-2.el9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | 15.8-3.el9_2 | Patch available | CNA |
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 15.8-3.el7 Patch available CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 15.8-1.el7 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 15.8-4.el8_9 Patch available CNA
- Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8_2 Patch available CNA
- Red Hat Enterprise Linux 8.2 Telecommunications Update Service VendorRed Hat Affected — Fixed in 15.8-2.el8_2 Patch available CNA
- Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 15.8-2.el8_2 Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8_4 Patch available CNA
- Red Hat Enterprise Linux 8.4 Telecommunications Update Service VendorRed Hat Affected — Fixed in 15.8-2.el8_4 Patch available CNA
- Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 15.8-2.el8_4 Patch available CNA
- Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8_6 Patch available CNA
- Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8 Patch available CNA
- Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 15.8-4.el9_3 Patch available CNA
- Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-3.el9 Patch available CNA
- Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el9 Patch available CNA
- Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el9 Patch available CNA
- Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-3.el9_2 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:shim:*:*:*:*:*:*:*:* | before 15.8 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:shim:*:*:*:*:*:*:*:* Versions before 15.8 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
Remediation
Red Hat 9 advisories
- RHSA-2024:2086 Released 2024-04-29 · Red Hat rating Importantshim security update
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) shim-15.8-2.el8_6, shim-aa64-15.8-2.el8_6, shim-ia32-15.8-2.el8_6 +1
- RHSA-2024:1959 Released 2024-04-23 · Red Hat rating Importantshim security update
- Red Hat Enterprise Linux Client (v. 7) mokutil-15.8-1.el7, shim-15.8-3.el7, shim-ia32-15.8-1.el7 +4
- Red Hat Enterprise Linux Server (v. 7) mokutil-15.8-1.el7, shim-15.8-3.el7, shim-ia32-15.8-1.el7 +4
- Red Hat Enterprise Linux Workstation (v. 7) mokutil-15.8-1.el7, shim-15.8-3.el7, shim-ia32-15.8-1.el7 +4
- RHSA-2024:1902 Released 2024-04-18 · Red Hat rating Importantshim security update
- Red Hat Enterprise Linux BaseOS (v. 8) shim-15.8-4.el8_9, shim-aa64-15.8-4.el8_9, shim-ia32-15.8-4.el8_9 +1
Show 6 more Red Hat advisories
- RHSA-2024:1903 Released 2024-04-18 · Red Hat rating Importantshim bug fix update
- Red Hat Enterprise Linux BaseOS (v. 9) shim-15.8-4.el9_3, shim-aa64-15.8-4.el9_3, shim-x64-15.8-4.el9_3
- RHSA-2024:1883 Released 2024-04-18 · Red Hat rating Importantshim security update
- Red Hat CodeReady Linux Builder EUS (v.8.8) shim-unsigned-x64-15.8-2.el8
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) shim-15.8-2.el8, shim-aa64-15.8-2.el8, shim-ia32-15.8-2.el8 +1
- RHSA-2024:1876 Released 2024-04-18 · Red Hat rating Importantshim bug fix update
- Red Hat Enterprise Linux BaseOS EUS (v.9.2) shim-15.8-3.el9_2, shim-aa64-15.8-3.el9_2, shim-x64-15.8-3.el9_2
- RHSA-2024:1873 Released 2024-04-18 · Red Hat rating Importantshim security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.4) shim-15.8-2.el8_4, shim-ia32-15.8-2.el8_4, shim-x64-15.8-2.el8_4
- Red Hat Enterprise Linux BaseOS E4S (v.8.4) shim-15.8-2.el8_4, shim-ia32-15.8-2.el8_4, shim-x64-15.8-2.el8_4
- Red Hat Enterprise Linux BaseOS TUS (v.8.4) shim-15.8-2.el8_4, shim-ia32-15.8-2.el8_4, shim-x64-15.8-2.el8_4
- RHSA-2024:1835 Released 2024-04-16 · Red Hat rating Importantshim security update
- Red Hat CodeReady Linux Builder EUS (v.9.0) shim-unsigned-x64-15.8-2.el9
- Red Hat Enterprise Linux AppStream EUS (v.9.0) shim-unsigned-aarch64-15.8-2.el9
- Red Hat Enterprise Linux BaseOS EUS (v.9.0) shim-15.8-3.el9, shim-aa64-15.8-3.el9, shim-x64-15.8-3.el9
- RHSA-2024:1834 Released 2024-04-16 · Red Hat rating Importantshim security update
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2) shim-15.8-2.el8_2, shim-ia32-15.8-2.el8_2, shim-x64-15.8-2.el8_2
- Red Hat Enterprise Linux BaseOS E4S (v. 8.2) shim-15.8-2.el8_2, shim-ia32-15.8-2.el8_2, shim-x64-15.8-2.el8_2
- Red Hat Enterprise Linux BaseOS TUS (v. 8.2) shim-15.8-2.el8_2, shim-ia32-15.8-2.el8_2, shim-x64-15.8-2.el8_2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1834
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
- TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
- TI-2023-21351 Shim: out-of-bounds read printing error messagesPriority LOW 28
- Advisory ·
Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1835
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
- TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
- TI-2023-21351 Shim: out-of-bounds read printing error messagesPriority LOW 28
Show 7 more groups
- Advisory ·
Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1873
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
- TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
- TI-2023-21351 Shim: out-of-bounds read printing error messagesPriority LOW 28
- Advisory ·
Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1876
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
- TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
- TI-2023-21351 Shim: out-of-bounds read printing error messagesPriority LOW 28
- Advisory ·
Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1883
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
- TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
- TI-2023-21351 Shim: out-of-bounds read printing error messagesPriority LOW 28
- Advisory ·
Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1902
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
- TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
- TI-2023-21351 Shim: out-of-bounds read printing error messagesPriority LOW 28
- Advisory ·
Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1903
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
- TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
- TI-2023-21351 Shim: out-of-bounds read printing error messagesPriority LOW 28
- Advisory ·
Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1959
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
- TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
- TI-2023-21351 Shim: out-of-bounds read printing error messagesPriority LOW 28
- Advisory ·
Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:2086
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
- TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
- TI-2023-21351 Shim: out-of-bounds read printing error messagesPriority LOW 28
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat CodeReady Linux Builder EUS (v.8.8) | Fixed | RHSA-2024:1883 |
| Red Hat CodeReady Linux Builder EUS (v.9.0) | Fixed | RHSA-2024:1835 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2024:1835 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2024:1902 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2024:1903 |
| Red Hat Enterprise Linux BaseOS AUS (v. 8.2) | Fixed | RHSA-2024:1834 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.4) | Fixed | RHSA-2024:1873 |
| Red Hat Enterprise Linux BaseOS E4S (v. 8.2) | Fixed | RHSA-2024:1834 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.4) | Fixed | RHSA-2024:1873 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.6) | Fixed | RHSA-2024:2086 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.8) | Fixed | RHSA-2024:1883 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.0) | Fixed | RHSA-2024:1835 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.2) | Fixed | RHSA-2024:1876 |
| Red Hat Enterprise Linux BaseOS TUS (v. 8.2) | Fixed | RHSA-2024:1834 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.4) | Fixed | RHSA-2024:1873 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2024:1959 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2024:1959 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2024:1959 |
Timeline
- 2026-10-02 Threatist record created from CVE-2023-40547
- 2026-10-03 Alias added: GHSA-qjqj-4cq6-6f2f
References
More Red Hat Enterprise Linux vulnerabilities
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
- TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
Sources
- CVE-2023-40547 · CVE Program
- CVE-2023-40547 · NVD
- FIRST EPSS
- GHSA-qjqj-4cq6-6f2f · GitHub Advisory Database · CC BY 4.0
- CVE-2023-40547 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences