CVE-2023-40549

An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.

References

Affected packages

Git / github.com/rhboot/shim

Affected ranges

Type

GIT

Repo

https://github.com/rhboot/shim

Events

Introduced

Fixed

5914984a1ffeab841f482c791426d7ca9935a5e6

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "15.8"
        }
    ]
}

Affected versions

0.*

0.3

0.4

0.5

0.7

0.8

0.9

Other

15.*

15.2

15.3

15.4

15.5

15.5-rc2

15.6

15.6-rc2

15.7

shim-15.*

shim-15.3-rc1

shim-15.3-rc2

shim-15.3-rc3

shim-15.3-rc4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40549.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "39"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    }
]