Read the docs
TI-2023-21355 Aliases CVE-2023-40550GHSA-grx2-83w4-8647

Shim: out-of-bound read in verify_buffer_sbat()

Priority LOW 25CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Fix Fixed Red Hat: 9 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Enterprise Linux 7—15.8-3.el7Patch availableCNA
Red HatRed Hat Enterprise Linux 7—15.8-1.el7Patch availableCNA
Red HatRed Hat Enterprise Linux 8—15.8-4.el8_9Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—15.8-2.el8_2Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Telecommunications Update Service—15.8-2.el8_2Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Update Services for SAP Solutions—15.8-2.el8_2Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—15.8-2.el8_4Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service—15.8-2.el8_4Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions—15.8-2.el8_4Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support—15.8-2.el8_6Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—15.8-2.el8Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—15.8-2.el8Patch availableCNA
Red HatRed Hat Enterprise Linux 9—15.8-4.el9_3Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—15.8-3.el9Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—15.8-2.el9Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—15.8-2.el9Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—15.8-3.el9_2Patch availableCNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 15.8-3.el7 Patch available CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 15.8-1.el7 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 15.8-4.el8_9 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8_2 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Telecommunications Update Service VendorRed Hat Affected — Fixed in 15.8-2.el8_2 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 15.8-2.el8_2 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8_4 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Telecommunications Update Service VendorRed Hat Affected — Fixed in 15.8-2.el8_4 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 15.8-2.el8_4 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8_6 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el8 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 15.8-4.el9_3 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-3.el9 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el9 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-2.el9 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 15.8-3.el9_2 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:redhat:shim:*:*:*:*:*:*:*:*before 15.8VulnerableRed Hat
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39VulnerableFedoraproject
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
  • cpe:2.3:a:redhat:shim:*:*:*:*:*:*:*:* Versions before 15.8 Vulnerable ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat

Remediation

Red Hat 9 advisories

  • RHSA-2024:2086 Released 2024-04-29 · Red Hat rating Important
    shim security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.6) shim-15.8-2.el8_6, shim-aa64-15.8-2.el8_6, shim-ia32-15.8-2.el8_6 +1
  • RHSA-2024:1959 Released 2024-04-23 · Red Hat rating Important
    shim security update
    • Red Hat Enterprise Linux Client (v. 7) mokutil-15.8-1.el7, shim-15.8-3.el7, shim-ia32-15.8-1.el7 +4
    • Red Hat Enterprise Linux Server (v. 7) mokutil-15.8-1.el7, shim-15.8-3.el7, shim-ia32-15.8-1.el7 +4
    • Red Hat Enterprise Linux Workstation (v. 7) mokutil-15.8-1.el7, shim-15.8-3.el7, shim-ia32-15.8-1.el7 +4
  • RHSA-2024:1902 Released 2024-04-18 · Red Hat rating Important
    shim security update
    • Red Hat Enterprise Linux BaseOS (v. 8) shim-15.8-4.el8_9, shim-aa64-15.8-4.el8_9, shim-ia32-15.8-4.el8_9 +1
Show 6 more Red Hat advisories
  • RHSA-2024:1903 Released 2024-04-18 · Red Hat rating Important
    shim bug fix update
    • Red Hat Enterprise Linux BaseOS (v. 9) shim-15.8-4.el9_3, shim-aa64-15.8-4.el9_3, shim-x64-15.8-4.el9_3
  • RHSA-2024:1883 Released 2024-04-18 · Red Hat rating Important
    shim security update
    • Red Hat CodeReady Linux Builder EUS (v.8.8) shim-unsigned-x64-15.8-2.el8
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) shim-15.8-2.el8, shim-aa64-15.8-2.el8, shim-ia32-15.8-2.el8 +1
  • RHSA-2024:1876 Released 2024-04-18 · Red Hat rating Important
    shim bug fix update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.2) shim-15.8-3.el9_2, shim-aa64-15.8-3.el9_2, shim-x64-15.8-3.el9_2
  • RHSA-2024:1873 Released 2024-04-18 · Red Hat rating Important
    shim security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) shim-15.8-2.el8_4, shim-ia32-15.8-2.el8_4, shim-x64-15.8-2.el8_4
    • Red Hat Enterprise Linux BaseOS E4S (v.8.4) shim-15.8-2.el8_4, shim-ia32-15.8-2.el8_4, shim-x64-15.8-2.el8_4
    • Red Hat Enterprise Linux BaseOS TUS (v.8.4) shim-15.8-2.el8_4, shim-ia32-15.8-2.el8_4, shim-x64-15.8-2.el8_4
  • RHSA-2024:1835 Released 2024-04-16 · Red Hat rating Important
    shim security update
    • Red Hat CodeReady Linux Builder EUS (v.9.0) shim-unsigned-x64-15.8-2.el9
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) shim-unsigned-aarch64-15.8-2.el9
    • Red Hat Enterprise Linux BaseOS EUS (v.9.0) shim-15.8-3.el9, shim-aa64-15.8-3.el9, shim-x64-15.8-3.el9
  • RHSA-2024:1834 Released 2024-04-16 · Red Hat rating Important
    shim security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) shim-15.8-2.el8_2, shim-ia32-15.8-2.el8_2, shim-x64-15.8-2.el8_2
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.2) shim-15.8-2.el8_2, shim-ia32-15.8-2.el8_2, shim-x64-15.8-2.el8_2
    • Red Hat Enterprise Linux BaseOS TUS (v. 8.2) shim-15.8-2.el8_2, shim-ia32-15.8-2.el8_2, shim-x64-15.8-2.el8_2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1834

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1835

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
Show 7 more groups
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1873

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1876

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1883

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1902

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1903

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:1959

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 11 more products — RHSA-2024:2086

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-21352 Shim: rce in http boot support may lead to secure boot bypassPriority MEDIUM 46
    • TI-2023-21353 Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsPriority LOW 35
    • TI-2023-21354 Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe filePriority LOW 28
    Show all 6 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.8.8)Fixed RHSA-2024:1883
Red Hat CodeReady Linux Builder EUS (v.9.0)Fixed RHSA-2024:1835
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2024:1835
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2024:1902
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2024:1903
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2024:1834
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2024:1873
Red Hat Enterprise Linux BaseOS E4S (v. 8.2)Fixed RHSA-2024:1834
Red Hat Enterprise Linux BaseOS E4S (v.8.4)Fixed RHSA-2024:1873
Red Hat Enterprise Linux BaseOS EUS (v.8.6)Fixed RHSA-2024:2086
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2024:1883
Red Hat Enterprise Linux BaseOS EUS (v.9.0)Fixed RHSA-2024:1835
Red Hat Enterprise Linux BaseOS EUS (v.9.2)Fixed RHSA-2024:1876
Red Hat Enterprise Linux BaseOS TUS (v. 8.2)Fixed RHSA-2024:1834
Red Hat Enterprise Linux BaseOS TUS (v.8.4)Fixed RHSA-2024:1873
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2024:1959
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2024:1959
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2024:1959

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-40550
  2. 2026-10-03 Alias added: GHSA-grx2-83w4-8647

References

Advisory 11

  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
See all 1955 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences