Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems

CISA ADP · SSVC 2.0.3

Exploitation

None

Automatable

No

Technical impact

Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

• Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 15.8-3.el7 Patch available CNA
• Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 15.8-1.el7 Patch available CNA
• Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 15.8-4.el8_9 Patch available CNA
• Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8_2 Patch available CNA
• Red Hat Enterprise Linux 8.2 Telecommunications Update Service VendorRed Hat Affected — Fixed in 15.8-2.el8_2 Patch available CNA
• Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 15.8-2.el8_2 Patch available CNA
• Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8_4 Patch available CNA
• Red Hat Enterprise Linux 8.4 Telecommunications Update Service VendorRed Hat Affected — Fixed in 15.8-2.el8_4 Patch available CNA
• Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 15.8-2.el8_4 Patch available CNA
• Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8_6 Patch available CNA
• Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8 Patch available CNA
• Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8 Patch available CNA
• Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 15.8-4.el9_3 Patch available CNA
• Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-3.el9 Patch available CNA
• Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el9 Patch available CNA
• Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el9 Patch available CNA
• Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-3.el9_2 Patch available CNA

Records fixed by the same vendor advisory or release, as the CNA lists them.

• Advisory · 2024-01-25

  Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1834

  6 records · Highest priority Priority MEDIUM · 1 MEDIUM, 5 LOW

  Other records, highest priority first

  • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
  • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
  • TI-2023-21351 Shim: out-of-bounds read printing error messagesPriority LOW 28
  Show all 6 records → Advisory →
• Advisory · 2024-01-25

  Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1835

  6 records · Highest priority Priority MEDIUM · 1 MEDIUM, 5 LOW

  Other records, highest priority first

  • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
  • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
  • TI-2023-21351 Shim: out-of-bounds read printing error messagesPriority LOW 28
  Show all 6 records → Advisory →

1. 2026-10-02 Threatist record created from CVE-2023-40548
2. 2026-10-03 Alias added: GHSA-7cf2-63mg-hv4j

• TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypass CVSS 3.1HIGH 8.3
• TI-2014-02993 Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via… CVSS 2.0HIGH 7.5
• TI-2014-02994 Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a… CVSS 2.0HIGH 7.5
• TI-2022-11371 Out-of-bounds write in Red Hat Bootloader Team shim CVSS 3.1HIGH 7.8
• TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe file CVSS 3.1MEDIUM 6.2
• TI-2023-21351 Shim: out-of-bounds read printing error messages CVSS 3.1MEDIUM 6.2

• CVE-2023-40548 · CVE Program
• CVE-2023-40548 · NVD
• FIRST EPSS
• GHSA-7cf2-63mg-hv4j · GitHub Advisory Database · CC BY 4.0
• CVE-2023-40548 · Red Hat security data · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences