Out-of-bounds Write Affecting shim package, versions <15.8-1~deb12u1


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.54% (78th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-SHIM-6190487
  • published25 Jan 2024
  • disclosed25 Jan 2024

Introduced: 25 Jan 2024

CVE-2023-40547  (opens in a new tab)
CWE-787  (opens in a new tab)

How to fix?

Upgrade Debian:12 shim to version 15.8-1~deb12u1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream shim package and not the shim package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.

CVSS Scores

version 3.1