CVE-2023-40547: Shim: rce in http boot support may lead to secure boot bypass
A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.
Other sources
Redhat: CVE-2023-40547 Shim - RCE in HTTP boot support may lead to secure boot bypass
— Microsoft
rhboot shim could allow a remote attacker to execute arbitrary code on the system, caused by a out-of-bounds write flaw in the http boot support (httpboot.c). By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
The MSRC Vulnerability & Mitigations (V&M) team discovered a critical Remote Code Execution vulnerability in the latest version of the Linux shim (https://github.com/rhboot/shim). The shim's http boot support (httpboot.c) trusts attacker-controlled values when parsing an HTTP response, leading to a completely controlled out-of-bounds write primitive.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/shimto a version that resolves this vulnerability.Fixed in 15.8
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40547?
CVE-2023-40547 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2023-40547?
To fix CVE-2023-40547, apply the appropriate security patches provided by your vendor.
What products are affected by CVE-2023-40547?
CVE-2023-40547 affects various versions of Red Hat Shim and multiple Windows operating systems.
What are the consequences of exploiting CVE-2023-40547?
Exploiting CVE-2023-40547 can lead to complete control of the affected system through out-of-bounds writes.
Is CVE-2023-40547 under active exploitation?
There have been reports indicating that CVE-2023-40547 may be actively exploited in the wild.