CVE-2023-40546: Shim: out-of-bounds read printing error messages
A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.
Other sources
A NULL pointer dereference error exists in mirroroneesl() at mok.c. If shim fails to create a new ESL variable it tries to log an error message, however one of the variables used in the LogError() function doesn't match the format string and additionally it may be NULL. A successful attack may lead shim to crash resulting in a Denial-of-Service.
— Red Hat
rhboot shim is vulnerable to a denial of service, caused by a NULL pointer dereference f;aw in the mirroroneesl() function in mok.c. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause the application to crash.
— IBM
Shim: out-of-bounds read printing error messages
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40546?
CVE-2023-40546 is considered a moderate severity vulnerability due to its potential impact on system security.
How do I fix CVE-2023-40546?
To fix CVE-2023-40546, update Shim to version 15.8 or later on affected systems.
Which versions of Shim are affected by CVE-2023-40546?
CVE-2023-40546 affects Shim versions prior to 15.8.
What software is impacted by CVE-2023-40546?
CVE-2023-40546 impacts Red Hat Shim and various versions of Red Hat Enterprise Linux and Fedora.
Is there a workaround for CVE-2023-40546?
Currently, there are no documented workarounds for CVE-2023-40546; upgrading is recommended.