CVE-2023-40549: Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe file
An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.
Other sources
An out-of-bounds read issue exists in the verifybufferauthenticode() function in shim.c. This issue is due to adding an offset to a pointer and then accessing the result without proper bounds checking. This bug is reachable by providing a malformed PE file to shim. This code runs before signature validation of the PE file.
— Red Hat
rhboot shim is vulnerable to a denial of service, caused by an out-of-bounds read flaw in the verifybufferauthenticode() function in shim.c. By providing a specially crafted PE file, a local attacker could exploit this vulnerability to cause the application to crash.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40549?
CVE-2023-40549 has a medium severity rating due to the potential for denial of service.
How do I fix CVE-2023-40549?
To address CVE-2023-40549, update shim to version 15.8 or higher.
What causes CVE-2023-40549?
CVE-2023-40549 is caused by an out-of-bounds read vulnerability in shim when loading a crafted PE binary.
Which systems are affected by CVE-2023-40549?
CVE-2023-40549 affects Red Hat Shim versions below 15.8 and Fedora 39 along with Red Hat Enterprise Linux 8.0 and 9.0.
What are the potential impacts of CVE-2023-40549?
The main impact of CVE-2023-40549 is a denial of service, which can crash shim when exploited.