Out-of-bounds read in Shim - CVE-2023-40549

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU86238

Out-of-bounds read in Shim - CVE-2023-40549

Published: February 7, 2024


Vulnerability identifier: #VU86238
CSH Severity: Medium
CVSS v4 BT: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-40549
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the verify_buffer_authenticode()  function when parsing PE binary. A remote attacker can pass a specially crafted PE binary to the loader, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.


Affected software

Shim
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
Anolis OS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
openEuler
Juniper Secure Analytics (JSA)
Storage Resource Manager
Dell EMC Storage Monitoring and Reporting (SMR)
Dell Secure Connect Gateway
IBM Power Hardware Management Console (HMC)
IBM Qradar SIEM
Dell EMC VxRail Appliance
shim-debugsource
shim
shim-debuginfo
shim-x64
shim-aa64
shim-unsigned-x64
shim-unsigned-ia32
shim-signed (Red Hat package)
shim-ia32
mokutil
shim-unsigned-aarch64
shim-unsigned-x64 (Red Hat package)
shim (Red Hat package)
shim-unsigned-aarch64 (Red Hat package)

How to mitigate CVE-2023-40549

Install updates from vendor's website.

Shim - update to 15.8
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
Storage Resource Manager - update to 5.0.1.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
Dell Secure Connect Gateway - update to 5.24.00.14
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF03
Dell EMC VxRail Appliance - update to 8.0.212
IBM Power Hardware Management Console (HMC) - addressed in versions 10.2.1040.0 SP2, 10.3.1060.0
shim-debugsource - addressed in versions 15.4-13, 15.6-16, 15.6-17, 15.6-19
shim - addressed in versions 15.4-13, 15.6-16, 15.6-17, 15.6-19
shim-debuginfo - addressed in versions 15.4-13, 15.6-16, 15.6-17, 15.6-19
shim-x64 - addressed in versions 15.7-3, 15.8-1, 15.8-1.0.1, 15.8-2.0.1
shim-aa64 - addressed in versions 15.7-3, 15.8-1, 15.8-1.0.1, 15.8-2.0.1
shim-unsigned-x64 - addressed in versions 15.8-1, 15.8-2.0.1, 15.8-3.0.1
shim-unsigned-ia32 - addressed in versions 15.8-1, 15.8-3.0.1
shim-signed (Red Hat package) - update to 15.8-1.el7
shim-ia32 - addressed in versions 15.8-1.0.1, 15.8-2.0.1
mokutil - update to 15.8-1.0.1
shim-unsigned-aarch64 - update to 15.8-2
shim-unsigned-x64 (Red Hat package) - addressed in versions 15.8-2.el8, 15.8-2.el9
shim (Red Hat package) - addressed in versions 15.8-2.el8, 15.8-2.el8_2, 15.8-2.el8_4, 15.8-2.el8_6, 15.8-3.el7, 15.8-3.el9, 15.8-3.el9_2, 15.8-4.el8_9, 15.8-4.el9_3
shim-unsigned-aarch64 (Red Hat package) - update to 15.8-2.el9
shim - addressed in versions 15.8-25.30.1, 15.8-150100.3.38.1
shim-debugsource - update to 15.8-150100.3.38.1
shim-debuginfo - update to 15.8-150100.3.38.1

External References

Related Security Bulletins