CVE-2023-40547: High HTTP Boot Out-of-Bounds Write in Shim

CVE-2023-40547 is a high severity out-of-bounds write in Shim, the UEFI first-stage boot loader. NVD scores it 8.3. A flaw in HTTP boot parsing can give an attacker control of the write, but only during early boot. Apply your distribution's shim update, such as Red Hat's RHSA-2024:1834 for the matching stream.

What's affected

The NVD description says Shim's HTTP boot support trusts attacker-controlled values when it parses an HTTP response. That produces an out-of-bounds write that the attacker controls. The weaknesses are CWE-787, out-of-bounds write, and CWE-346, origin validation error.

The record's product list names Red Hat's shim package and Red Hat Enterprise Linux 7, 8 and 9. Red Hat Enterprise Linux is only the vendor named in the record, since Shim is used across Linux distributions. Check your own distribution's security tracker.

The fixed versions depend on your stream. The record cites six Red Hat advisories: RHSA-2024:1834, 1835, 1873, 1876, 1883 and 1902. I read RHSA-2024:1834, issued 16 April 2024. It is rated Important and covers RHEL 8.2 Advanced Update Support, 8.2 Update Services for SAP Solutions and 8.2 Telecommunications Update Service. I did not open the other five, so match your release to the right advisory and use the package version it names.

Severity note: NVD scores this 8.3 (High) with an adjacent network vector and high attack complexity. Red Hat rates the update Important. Those labels come from different scales, so use the CVSS number and your own boot design to judge urgency.

It is not in CISA's KEV catalog, and the description says exploitation needs a man-in-the-middle position or a compromised boot server during early boot.

How to check if you're exposed

Check the installed shim package and whether its changelog mentions the CVE. On RHEL and compatible systems:

rpm -q shim-x64
rpm -q --changelog shim-x64 | grep CVE-2023-40547

Vendors backport fixes without changing the upstream version number, so a changelog hit or the version named in your advisory is the right test, not the version string alone. On Debian and Ubuntu systems, query the package with dpkg and compare it against your distribution's tracker:

dpkg -l | grep -i shim

Then ask whether you use HTTP boot at all. The description ties the flaw to Shim's HTTP boot support. Machines that boot from local disk and never use network boot are in a different position from those that fetch a boot image over HTTP.

What to do now

1. List the hosts that run Shim and identify which of them use HTTP boot or network boot.
2. Match each host to its distribution's advisory and apply the shim update.
3. Remember that shim is signed boot code. Updating the package is not always the whole job, so follow the advisory's instructions for the new binary to take effect on the next boot.
4. Reduce the attack surface for early boot: keep boot servers on isolated, authenticated networks and prefer encrypted transport where your tooling allows.
5. Reboot and confirm the new version after the update, then record the result.

Why it matters

Shim sits at the start of the secure boot chain. It runs before the operating system and decides which boot loader to trust. A memory write bug here is serious because code that runs this early can act before most security controls exist.

The weakness is a trust issue. The code reads values from an HTTP response and uses them without checking them, which yields a write outside the intended buffer. The record notes that an attacker needs to be a man in the middle or to control the boot server, and the attack vector in the vector string is adjacent, which is why the score stops at 8.3 rather than higher. The scope is marked as changed, since a compromise at boot affects everything that runs afterward.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Red Hat advisory RHSA-2024:1834
• Other Red Hat advisories listed by NVD: RHSA-2024:1835, 1873, 1876, 1883 and 1902 (not opened for this post)
• Safeguard Gold entry for CVE-2023-40547

Last reviewed: 19 October 2026.