VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 29, 2024· Updated Jan 27, 2026

Shim: out-of-bound read in verify_buffer_sbat()

CVE-2023-40550

Description

An out-of-bounds read in Shim's SBAT validation may leak sensitive memory during system boot, affecting multiple Red Hat Enterprise Linux versions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

An out-of-bounds read in Shim's SBAT validation may leak sensitive memory during system boot, affecting multiple Red Hat Enterprise Linux versions.

Vulnerability

An out-of-bounds read flaw exists in Shim, a first-stage UEFI boot loader, when it validates the SBAT (Secure Boot Advanced Targeting) information. This vulnerability affects Shim versions prior to the fix provided in Red Hat Enterprise Linux 8.6 Extended Update Support and other affected products. The issue is triggered during the boot phase when Shim processes malformed SBAT data [2][4].

Exploitation

An attacker with physical access or the ability to control the boot process (e.g., by supplying a crafted SBAT policy or malicious boot media) could trigger the out-of-bounds read. No elevated privileges are required once the attacker can influence the boot chain; the flaw manifests during legitimate SBAT validation [2][4].

Impact

Successful exploitation leads to an out-of-bounds read, which may expose sensitive data from memory during the system boot phase. The information disclosure could include cryptographic material or other secrets used by the boot process, potentially weakening Secure Boot guarantees. The vulnerability does not directly enable code execution but increases the attack surface for further compromise [1][2].

Mitigation

Red Hat has released security updates for Shim as part of RHSA-2024:1903, RHSA-2024:1959, and RHSA-2024:2086, which were published on 2024-01-29 and 2024-04-29. These updates address the out-of-bounds read by correcting the boundary checks in the verify_buffer_sbat() function. Affected systems should apply the latest shim packages from their respective updates. No workaround is documented; users must upgrade to fixed versions. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of publication [1][3][4].

References
  1. https://access.redhat.com/errata/RHSA-2024:1903
  2. cve-details
  3. https://access.redhat.com/errata/RHSA-2024:1959
  4. https://access.redhat.com/errata/RHSA-2024:2086

AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

39

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.