shim (verify_buffer_authenticode): Out-of-bounds read on a malformed PE file crashes shim and blocks boot

CVSS 5.5CVE-2023-40549Firmware, BMC & network fabricshim 15.8 batchcurated

Impact

Out-of-bounds read on a malformed PE file crashes shim and blocks boot. Same operational cost as the other shim DoS - a node that will not boot needs hands or BMC per box.

Who can reach it

A malformed EFI binary in the boot path.

What to do

shim package update + reboot.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-40549 https://www.openwall.com/lists/oss-security/2024/01/26/1

Related entries

shim (verify_buffer_sbat): Out-of-bounds read in SBAT verification discloses adjacent boot-time memory to an attackerCVE-2023-40550 · shim (verify_buffer_sbat)Medium
Linux kernel (drivers/infiniband/sw/rxe): Soft-RoCE queue-pair cleanup drains send and receive work queues that aCVE-2023-53528 · Linux kernel (drivers/infiniband/sw/rxe)Medium
Linux kernel (drivers/infiniband/sw/rxe): If soft-RoCE queue-pair creation fails partway, the unwind path runs cleanupCVE-2023-54028 · Linux kernel (drivers/infiniband/sw/rxe)Medium
Linux bnxt_re RoCE driver (chip context memory leak): Memory leak in the Broadcom RoCE driver when doorbell BAR mappingCVE-2024-50172 · Linux bnxt_re RoCE driver (chip context memory leak)Medium
Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): When the driver runs out of firmware command slots, the workCVE-2025-21662 · Linux kernel (drivers/net/ethernet/mellanox/mlx5/core)Medium
Linux kernel (drivers/infiniband/hw/mlx5): Memory-region deregistration hangs forever on the flagship AI-cluster NIC. ACVE-2025-21886 · Linux kernel (drivers/infiniband/hw/mlx5)Medium

All Firmware, BMC & network fabric entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.