PT-2024-2764 · Shim+6 · Shim+6

Marco Benatto · CVE-2023-40550 · Published 2024-01-23 · Updated 2025-03-07

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shim (affected versions not specified)

Description The issue is related to an out-of-bounds read flaw in Shim when it attempts to validate the SBAT information. This flaw may expose sensitive data during the system's boot phase.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2024:1902

ALSA-2024:1903

ALT-PU-2024-1671

ALT-PU-2024-1869

ALT-PU-2024-1877

ALT-PU-2024-4050

AZL-34094

AZL-34159

AZL-35257

AZL-35265

AZL-35277

BDU:2024-02898

CESA-2024_1902

CVE-2023-40550

DLA-3813-1

OESA-2024-1117

OESA-2024-1118

OESA-2024-1119

OESA-2024-1120

OPENSUSE-SU-2024_1368-1

RHSA-2024:1834

RHSA-2024:1835

RHSA-2024:1873

RHSA-2024:1876

RHSA-2024:1883

RHSA-2024:1902

RHSA-2024:1903

RHSA-2024:1959

RHSA-2024:2086

RHSA-2024_1902

RHSA-2024_1903

RHSA-2024_1959

SUSE-SU-2024:1368-1

SUSE-SU-2024:1461-1

SUSE-SU-2024:1462-1

SUSE-SU-2025:20136-1

Affected Products

Alt Linux

Almalinux

Centos

Red Hat

Red Os

Shim

Suse

References · 99

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40550.json · Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=2259915 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:1903 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35277 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1903 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40550 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40550 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-40550 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1118 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02898 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-40550 · Security Note
• https://access.redhat.com/errata/RHSA-2024:1959 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1368-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-1959.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-34159 · Vendor Advisory