VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 25, 2024· Updated Nov 20, 2025

Shim: rce in http boot support may lead to secure boot bypass

CVE-2023-40547

Description

Shim's HTTP boot support contains a remote code execution vulnerability due to trusting attacker-controlled HTTP response values, leading to an out-of-bounds write and potential system compromise during early boot.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Shim's HTTP boot support contains a remote code execution vulnerability due to trusting attacker-controlled HTTP response values, leading to an out-of-bounds write and potential system compromise during early boot.

Vulnerability

A remote code execution vulnerability exists in the Shim first-stage UEFI boot loader's HTTP boot support. When Shim parses an HTTP response during network boot, it trusts attacker-controlled values without proper validation. This flaw allows an attacker to craft a malicious HTTP request that triggers a completely controlled out-of-bounds write primitive. The vulnerability is present in Shim versions shipped with various Red Hat Enterprise Linux releases, including those for x86_64 and ARM 64 architectures. Red Hat advisories RHSA-2024:1903, RHSA-2024:1959, and RHSA-2024:2086 address this issue, indicating it affects multiple product streams [1][4].

Exploitation

Exploitation requires the attacker to have network-level access during the early boot phase, either by performing a Man-in-the-Middle attack between the target system and the boot server or by compromising the boot server itself. The attacker sends a specially crafted HTTP response to the Shim boot loader, which processes the malicious data. No user interaction is needed once the system boots over the network. The vulnerability is only exploitable during the UEFI boot process when HTTP boot is used [2].

Impact

Successful exploitation allows the attacker to execute arbitrary code with high privileges within the boot environment. This can lead to complete system compromise, including bypassing Secure Boot protection. The out-of-bounds write primitive enables the attacker to overwrite critical memory regions, potentially allowing persistent control over the system's boot chain. The CVSS base score is important severity, reflecting the high impact on confidentiality, integrity, and availability [2].

Mitigation

Red Hat has released updated Shim packages to fix this vulnerability. The fix is included in RHSA-2024:1903 for Red Hat Enterprise Linux 8, RHSA-2024:1959 for Red Hat Enterprise Linux 9, and RHSA-2024:2086 for Red Hat Enterprise Linux 8.6 Extended Update Support, published on April 29, 2024 [1][3][4]. Users should apply the updates promptly. As a workaround, organizations can disable HTTP boot or use only HTTPS boot servers with properly verified certificates. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.

References
  1. https://access.redhat.com/errata/RHSA-2024:1903
  2. cve-details
  3. https://access.redhat.com/errata/RHSA-2024:1959
  4. https://access.redhat.com/errata/RHSA-2024:2086

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

39

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.