6.2Medium

CVE-2023-40549Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe file

Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Red Hat Enterpris… Published: 2024-01-29 19:29 (2 years ago)

Description

An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.

Weakness (CWE): CWE-125

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
enterprise linux	7	—
enterprise linux	8	—
enterprise linux	9	—
Red Hat	Red Hat Enterprise Linux 7	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	all versions
rhel aus	8.2	—
rhel aus	8.4	—
rhel e4s	8.2	—
rhel e4s	8.4	—
rhel eus	8.6	—
rhel eus	8.8	—
rhel eus	9.0	—
rhel eus	9.2	—
rhel tus	8.2	—
rhel tus	8.4	—

References and patches

RHSA-2024:1834 vendor-advisory
RHSA-2024:1835 vendor-advisory
RHSA-2024:1873 vendor-advisory
RHSA-2024:1876 vendor-advisory
RHSA-2024:1883 vendor-advisory
RHSA-2024:1902 vendor-advisory
RHSA-2024:1903 vendor-advisory
RHSA-2024:1959 vendor-advisory
RHSA-2024:2086 vendor-advisory
https://access.redhat.com/security/cve/CVE-2023-40549 vdb-entry
RHBZ#2241797 issue-tracking

CVSS score

6.2Medium

Source: redhat · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (chance of exploitation in 30 days)

0.41%

higher than 36% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2023-08-15
Published2024-01-29 19:29
Reached IP-DB2026-10-24 23:52
Last updated2025-11-20 22:53

Assigned by (CNA): redhat

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Red Hat Enterprise Linux

8.8High

CVE-2026-18379 yesterday

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…

5.5Medium

CVE-2026-127101 yesterday