CVE-2023-40546 Shim: out-of-bounds read printing error messages
A flaw in Shim causes a crash when printing error messages due to mismatched parameters, leading to denial of service during variable creation failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-40546?
CVE-2023-40546 is a medium-severity vulnerability in Fedoraproject Fedora, published on 29 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.
Weakness: CWE-476
Which versions are affected by CVE-2023-40546?
It affects 3 products.
Products include Fedoraproject Fedora, Redhat Enterprise Linux, Redhat Shim.
How do I fix CVE-2023-40546?
Apply the vendor's patch.
Is CVE-2023-40546 being exploited?
There is no known exploitation of CVE-2023-40546 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-33984, AZL-34157, AZL-35253, AZL-35261, AZL-35271, BELL-CVE-2023-40546 and 6 more.