Red Hat Security Advisory: shim security update

Fixed packages 24

Vulnerabilities 6

• High 8.3
  CVE-2023-40547

  Shim: rce in http boot support may lead to secure boot bypass

  A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 25, 2024
• High 7.4
  CVE-2023-40548

  Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems

  A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 29, 2024
• Medium 6.2
  CVE-2023-40546

  Shim: out-of-bounds read printing error messages

  A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the forma…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 29, 2024
• Medium 6.2
  CVE-2023-40549

  Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe file

  An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 29, 2024
• Medium 5.5
  CVE-2023-40550

  Shim: out-of-bound read in verify_buffer_sbat()

  An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 29, 2024
• Medium 5.1
  CVE-2023-40551

  Shim: out of bounds read when parsing mz binaries

  A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 29, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2234589
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2241782
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2241796
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2241797
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259915
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259918
• article
  https://issues.redhat.com/browse/RHEL-2155
• article
  https://issues.redhat.com/browse/RHEL-4382
• article
  https://issues.redhat.com/browse/RHEL-4390
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1959.json
• report
  https://access.redhat.com/security/cve/CVE-2023-40546
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-40546
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-40546
• report
  https://access.redhat.com/security/cve/CVE-2023-40547
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-40547
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-40547
• report
  https://access.redhat.com/security/cve/CVE-2023-40548
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-40548
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-40548
• report
  https://access.redhat.com/security/cve/CVE-2023-40549
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-40549
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-40549
• report
  https://access.redhat.com/security/cve/CVE-2023-40550
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-40550
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-40550
• report
  https://access.redhat.com/security/cve/CVE-2023-40551
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-40551
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-40551