Redhat Shim vulnerabilities

CVE-2023-40547 [HIGH] CWE-787 CVE-2023-40547: A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-contr A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during th

CVE-2014-3676 [HIGH] CWE-787 CVE-2014-3676: Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted I Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVE-2014-3677 [HIGH] CVE-2014-3677: Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2023-40548 [HIGH] CWE-190 CVE-2023-40548: A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition op A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or d

CVE-2022-28737 [HIGH] CWE-787 CVE-2022-28737: There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI execut There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.

CVE-2021-3695 [MEDIUM] grub2-signed, grub2-unsigned, shim, and shim-signed vulnerability grub2-signed, grub2-unsigned, shim, and shim-signed vulnerability Daniel Axtens discovered that specially crafted images could cause a heap-based out-of-bonds write. A local attacker could possibly use this to circumvent secure boot protections. (CVE-2021-3695) Daniel Axtens discovered that specially crafted images could cause out-of-bonds read and write. A local attacker could possibly use this to circumv

CVE-2014-3675 [MEDIUM] CWE-125 CVE-2014-3675: Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

CVE-2023-40550 [MEDIUM] CWE-125 CVE-2023-40550: An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This is An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.

CVE-2023-40549 [MEDIUM] CWE-125 CVE-2023-40549: An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.

CVE-2023-40551 [MEDIUM] CWE-125 CVE-2023-40551: A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a cras A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.

CVE-2023-40546 [MEDIUM] CWE-476 CVE-2023-40546: A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.