CVE-2023-40547 Shim: rce in http boot support may lead to secure boot bypass

High 8.3 Published 25 Jan 2024 Updated 26 Jun 2026

Attacker can execute arbitrary code and bypass Secure Boot via malicious HTTP response during early boot phase.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-40547?

CVE-2023-40547 is a high-severity memory corruption vulnerability in Redhat Enterprise Linux, published on 25 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.

Weakness: CWE-346, CWE-787

Which versions are affected by CVE-2023-40547?

It affects 2 products.

Products include Redhat Enterprise Linux, Redhat Shim.

How do I fix CVE-2023-40547?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-40547 being exploited?

There is no known exploitation of CVE-2023-40547 in the wild and no public exploit code.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as AZL-33895, AZL-34030, AZL-35254, AZL-35267, AZL-35278, BELL-CVE-2023-40547 and 3 more.