VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 29, 2024· Updated Nov 20, 2025

Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems

CVE-2023-40548

Description

A heap-buffer-overflow in Shim's 32-bit UEFI boot loader allows an attacker to corrupt memory during secure boot via a crafted PE binary.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A heap-buffer-overflow in Shim's 32-bit UEFI boot loader allows an attacker to corrupt memory during secure boot via a crafted PE binary.

Vulnerability

Shim, a first-stage UEFI boot loader used in secure boot environments, contains a heap-based buffer overflow in its 32-bit code path. The vulnerability occurs when an addition operation using a user-controlled value parsed from a PE binary is used for memory allocation. This leads to memory corruption when processing the SBAT section on 32-bit systems. Affected versions include all Shim builds prior to the patches released in Red Hat Enterprise Linux advisories RHSA-2024:1903, RHSA-2024:1959, and RHSA-2024:2086 [1], [2], [3], [4].

Exploitation

An attacker with the ability to supply a crafted PE binary during the boot process (e.g., via a malicious boot loader or a compromised boot medium) can trigger the overflow. The attacker does not need authenticated access to the operating system itself; physical access or control over the boot chain is required. By manipulating the value that controls memory allocation, the attacker can cause a heap overflow, which may lead to controlled memory corruption [2].

Impact

Successful exploitation results in memory corruption during the early boot phase, potentially leading to a system crash or data integrity issues. In a more severe scenario, the overflow could be leveraged to bypass Secure Boot protections, allowing an attacker to load unsigned code and gain persistent control over the boot process. The vulnerability is rated Important by Red Hat [2], [4].

Mitigation

Red Hat released fixes for CVE-2023-40548 as part of shim updates in April 2024: RHSA-2024:1903 (for RHEL 8), RHSA-2024:1959 (for RHEL 9), and RHSA-2024:2086 (for RHEL 8.6 Extended Update Support) [1], [3], [4]. System administrators should update the shim package to the patched version. No workaround is documented; updating is the recommended mitigation. There is no evidence that this CVE is listed in the Known Exploited Vulnerabilities catalog.

References
  1. https://access.redhat.com/errata/RHSA-2024:1903
  2. cve-details
  3. https://access.redhat.com/errata/RHSA-2024:1959
  4. https://access.redhat.com/errata/RHSA-2024:2086

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

39

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.