6.2Medium

CVE-2023-40546Shim: out-of-bounds read printing error messages

Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Red Hat Enterpris… Published: 2024-01-29 19:29 (2 years ago)

Description

A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.

Weakness (CWE): CWE-476

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
enterprise linux	7	—
enterprise linux	8	—
enterprise linux	9	—
Red Hat	Red Hat Enterprise Linux 7	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	all versions
rhel aus	8.2	—
rhel aus	8.4	—
rhel e4s	8.2	—
rhel e4s	8.4	—
rhel eus	8.6	—
rhel eus	8.8	—
rhel eus	9.0	—
rhel eus	9.2	—
rhel tus	8.2	—
rhel tus	8.4	—

References and patches

RHSA-2024:1834 vendor-advisory
RHSA-2024:1835 vendor-advisory
RHSA-2024:1873 vendor-advisory
RHSA-2024:1876 vendor-advisory
RHSA-2024:1883 vendor-advisory
RHSA-2024:1902 vendor-advisory
RHSA-2024:1903 vendor-advisory
RHSA-2024:1959 vendor-advisory
RHSA-2024:2086 vendor-advisory
https://access.redhat.com/security/cve/CVE-2023-40546 vdb-entry
RHBZ#2241796 issue-tracking

CVSS score

6.2Medium

Source: redhat · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (chance of exploitation in 30 days)

0.44%

higher than 39% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2023-08-15
Published2024-01-29 19:29
Reached IP-DB2026-10-24 23:52
Last updated2025-11-20 22:53

Assigned by (CNA): redhat

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Red Hat Enterprise Linux

8.8High

CVE-2026-18379 14 hours ago

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…

5.5Medium

CVE-2026-127101 15 hours ago