LiveActive security incident?Get immediate response
CVE Record

CVE-2023-40547: Shim: rce in http boot support may lead to secure boot bypass

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.

HighCVSS 8.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2023-40547 is a flaw in Shim’s HTTP boot handling. If an attacker can intercept boot traffic or compromise the boot server, they may run code during early boot and potentially bypass Secure Boot protections. This is serious for organizations using network-based HTTP boot, especially on affected Red Hat Enterprise Linux systems.

Executive priority

Treat as high priority for environments using network boot, provisioning networks, or RHEL Secure Boot at scale. Patch during the next urgent maintenance window. Prioritize boot infrastructure and systems that can boot over HTTP, because exploitation depends on controlling or intercepting boot traffic.

Technical view

Shim trusts attacker-controlled values while parsing an HTTP response, causing a CWE-787 out-of-bounds write. Red Hat describes potential remote code execution and complete system compromise during early boot. CVSS is 8.3 with adjacent attack vector, high complexity, no privileges, no user interaction, and scope changed.

Likely exposure

Highest exposure is on affected RHEL systems using Shim with HTTP boot workflows. Exploitation requires early boot timing plus a man-in-the-middle position or compromised boot server. Systems not using HTTP boot are less directly exposed, but affected Shim packages should still be updated per vendor guidance.

Exploitation context

The provided sources do not show CISA KEV listing or confirmed active exploitation. Exploitation is constrained: the attacker must influence HTTP boot responses during early boot, typically through network interception or boot-server compromise. Successful exploitation could undermine boot trust before the operating system loads.

Researcher notes

Key constraints are early-boot reachability and attacker control of HTTP boot responses. Red Hat lists multiple affected RHEL 7, 8, and 9 Shim package builds and related errata. Evidence provided does not establish active exploitation. Avoid assuming impact for unlisted products without vendor confirmation.

Mitigation direction

  • Apply the relevant Red Hat RHSA updates for affected RHEL versions and streams.
  • Update affected shim, shim-signed, and shim-unsigned packages where applicable.
  • Review vendor guidance for non-Red Hat distributions using Shim.
  • Protect HTTP boot networks from interception and unauthorized server changes.
  • Audit boot servers for compromise and unauthorized configuration changes.

Validation and detection

  • Inventory systems using UEFI Secure Boot and Shim.
  • Identify systems using HTTP boot or network provisioning workflows.
  • Compare installed Shim package versions against affected versions in vendor advisories.
  • Confirm applicable RHSA updates are installed successfully.
  • Review boot infrastructure access controls and change history.
Prepared
Confidence
high
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-787: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-40547 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
2ADP providers
13Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.3CVSS 3.1HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H1.66redhat

Vulnerability scoring details

Base CVSS 3.1 score

8.3High
CVSS 3.1 vector shape for CVE-2023-40547Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineredhat

    Reported to Red Hat.

  2. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  3. Source timelineredhat

    Made public.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Red HatRed Hat Enterprise Linux 7shim, 0:15.8-3.el7affected
Red HatRed Hat Enterprise Linux 7shim-signed, 0:15.8-1.el7affected
Red HatRed Hat Enterprise Linux 8shim, 0:15.8-4.el8_9affected
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Supportshim, 0:15.8-2.el8_2affected
Red HatRed Hat Enterprise Linux 8.2 Telecommunications Update Serviceshim, 0:15.8-2.el8_2affected
Red HatRed Hat Enterprise Linux 8.2 Update Services for SAP Solutionsshim, 0:15.8-2.el8_2affected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportshim, 0:15.8-2.el8_4affected
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Serviceshim, 0:15.8-2.el8_4affected
Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutionsshim, 0:15.8-2.el8_4affected
Red HatRed Hat Enterprise Linux 8.6 Extended Update Supportshim, 0:15.8-2.el8_6affected
Red HatRed Hat Enterprise Linux 8.8 Extended Update Supportshim, 0:15.8-2.el8affected
Red HatRed Hat Enterprise Linux 8.8 Extended Update Supportshim-unsigned-x64, 0:15.8-2.el8affected
Red HatRed Hat Enterprise Linux 9shim, 0:15.8-4.el9_3affected
Red HatRed Hat Enterprise Linux 9.0 Extended Update Supportshim, 0:15.8-3.el9affected
Red HatRed Hat Enterprise Linux 9.0 Extended Update Supportshim-unsigned-aarch64, 0:15.8-2.el9affected
Red HatRed Hat Enterprise Linux 9.0 Extended Update Supportshim-unsigned-x64, 0:15.8-2.el9affected
Red HatRed Hat Enterprise Linux 9.2 Extended Update Supportshim, 0:15.8-3.el9_2affected
Weakness

CWE details

CWE-787

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.