CVE-2023-40547: Red Hat Enterprise Linux

High severity, CVSS 8.3. EPSS: 5.4% chance of exploitation in the next 30 days.

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.

Affected products

• Red Hat Enterprise Linux: version 7.0 only; version 8.0 only; version 9.0 only
• Red Hat Shim: before 15.8 (fixed in 15.8)

Published 2024-01-25. Last modified 2026-06-26.