CVE-2023-40547: Shim: rce in http boot support may lead to secure boot bypass

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-25 · updated 2026-06-26
Weakness: CWE-787

Description

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.

Affected products

Red Hat Enterprise Linux: 7.0, 8.0, 9.0
Red Hat Bootloader Team shim: before 15.8 — fixed in 15.8

How to fix

Upgrade to a fixed version: Red Hat Bootloader Team shim 15.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-40547 or the next vulnerability affects your stack