A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.
Workaround:
The product writes data past the end, or before the beginning, of the intended buffer.
The product does not properly verify that the source of data or communication is valid.
| Link | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2024:1834 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2024:1835 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2024:1873 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2024:1876 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2024:1883 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2024:1902 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2024:1903 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2024:1959 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2024:2086 | vendor advisory |
| https://access.redhat.com/security/cve/CVE-2023-40547 | vdb entry vendor advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2234589 | vendor advisory issue tracking |
| http://www.openwall.com/lists/oss-security/2024/01/26/1 | |
| https://lists.debian.org/debian-lts-announce/2024/05/msg00009.html |