An update of the shim package has been released.

The version of shim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-40551 advisory.

  - A flaw was found in the MZ binary format in Shim. An out-of-bounds read May occur, leading to a crash or     possible exposure of sensitive data during the system's boot phase. (CVE-2023-40551)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of shim installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-40551 advisory.

  - A flaw was found in the MZ binary format in Shim. An out-of-bounds read May occur, leading to a crash or     possible exposure of sensitive data during the system's boot phase. (CVE-2023-40551)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0131 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2023-40546:
    A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create     the new variable, it tries to print an error message to the user; however, the number of parameters used     by the logging function doesn't match the format string used by it, leading to a crash under certain     circumstances.

    CVE-2023-40547:
    A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled     values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP     request, leading to a completely controlled out-of-bounds write primitive and complete system compromise.
    This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-     Middle or compromise the boot server to be able to exploit this vulnerability successfully.

    CVE-2023-40548:
    A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition     operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is     further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes     memory corruption and can lead to a crash or data integrity issues during the boot phase.

    CVE-2023-40549:
    An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the     load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and     crashing Shim, resulting in a denial of service.

    CVE-2023-40550:
    An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue     may expose sensitive data during the system's boot phase.

    CVE-2023-40551:
    A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or     possible exposure of sensitive data during the system's boot phase.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1903 advisory.

    [15.8-1.0.3]
    - Update shimx64.efi and shimaa64.efi v15.8 signed by Microsoft [Orabug: 36072879]
    - Update shim fb and mm binaries to match unsigned releases [Orabug: 36072879]

    [15.8-1.0.2]
    - Use binaries with correct shim.ol generation [Orabug: 36072879]
    - Set SBAT_AUTOMATIC_DATE=2021030218 [Orabug: 36072879]

    [15.8-1.0.1]
    - Update to 15.8 [Orabug: 36072879]
    - fix CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551     [Orabug: 36072879]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1959 advisory.

  - A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create     the new variable, it tries to print an error message to the user; however, the number of parameters used     by the logging function doesn't match the format string used by it, leading to a crash under certain     circumstances. (CVE-2023-40546)

  - A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled     values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP     request, leading to a completely controlled out-of-bounds write primitive and complete system compromise.
    This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-     Middle or compromise the boot server to be able to exploit this vulnerability successfully.
    (CVE-2023-40547)

  - A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition     operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is     further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes     memory corruption and can lead to a crash or data integrity issues during the boot phase. (CVE-2023-40548)

  - An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the     load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and     crashing Shim, resulting in a denial of service. (CVE-2023-40549)

  - An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue     may expose sensitive data during the system's boot phase. (CVE-2023-40550)

  - A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or     possible exposure of sensitive data during the system's boot phase. (CVE-2023-40551)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
205176	Photon OS 5.0: Shim PHSA-2024-5.0-0332	Nessus	PhotonOS Local Security Checks	2024/8/8	2024/8/8	high
207010	CBL Mariner 2.0 Security Update: shim (CVE-2023-40551)	Nessus	MarinerOS Local Security Checks	2024/9/12	2024/12/13	medium
232680	Azure Linux 3.0 Security Update: shim (CVE-2023-40551)	Nessus	Azure Linux Local Security Checks	2025/3/13	2025/9/15	medium
238653	TencentOS Server 3: shim (TSSA-2024:0131)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
193780	Oracle Linux 9 : shim (ELSA-2024-1903)	Nessus	Oracle Linux Local Security Checks	2024/4/24	2024/11/2	high
193955	CentOS 7 : shim (RHSA-2024:1959)	Nessus	CentOS Local Security Checks	2024/4/26	2024/4/26	high

检测

插件搜索

high

medium

medium

high

high

high