CVE-2023-40551

Summary

A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 70:15.8-3.el7 < *unaffected
Red HatRed Hat Enterprise Linux 70:15.8-1.el7 < *unaffected
Red HatRed Hat Enterprise Linux 80:15.8-4.el8_9 < *unaffected
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support0:15.8-2.el8_2 < *unaffected
Red HatRed Hat Enterprise Linux 8.2 Telecommunications Update Service0:15.8-2.el8_2 < *unaffected
Red HatRed Hat Enterprise Linux 8.2 Update Services for SAP Solutions0:15.8-2.el8_2 < *unaffected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support0:15.8-2.el8_4 < *unaffected
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service0:15.8-2.el8_4 < *unaffected
Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions0:15.8-2.el8_4 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support0:15.8-2.el8_6 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support0:15.8-2.el8 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support0:15.8-2.el8 < *unaffected
Red HatRed Hat Enterprise Linux 90:15.8-4.el9_3 < *unaffected
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support0:15.8-3.el9 < *unaffected
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support0:15.8-2.el9 < *unaffected
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support0:15.8-2.el9 < *unaffected
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support0:15.8-3.el9_2 < *unaffected

Weaknesses

  • CWE-125: Out-of-bounds Read

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References