PatchTheCVEshim vulnerabilities and fixes
Recent CVEs affecting shim, with upgrade or downgrade steps. 11 tracked.
shim has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 10. Most recent: 2024-01-29. Highest priority: CVE-2014-3676 (score 59/100).
- CVE-2023-40548 HIGH 7.4 UPGRADE MITIGATE A buffer overflow was found in Shim in the 32-bit system
- CVE-2023-40547 HIGH 8.3 UPGRADE MITIGATE A remote code execution vulnerability was found in Shim
- CVE-2023-40551 MEDIUM 5.1 UPGRADE MITIGATE A flaw was found in the MZ binary format in Shim
- CVE-2023-40550 MEDIUM 5.5 UPGRADE MITIGATE An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information
- CVE-2023-40549 MEDIUM 6.2 UPGRADE MITIGATE An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load o
- CVE-2023-40546 MEDIUM 6.2 UPGRADE MITIGATE A flaw was found in Shim when an error happened while creating a new ESL variable
- CVE-2022-28737 MEDIUM 6.5 UPGRADE There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The
- CVE-2014-8399 LOW 2.1 DOWNGRADE The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to
- CVE-2014-3677 HIGH 7.5 UPGRADE Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, whic
- CVE-2014-3676 HIGH 7.5 UPGRADE Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 addres
- CVE-2014-3675 MEDIUM 5.0 UPGRADE Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.
FAQ
How do I fix shim vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is shim being exploited right now?
None of the tracked shim CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which shim CVE should I patch first?
CVE-2014-3676 currently ranks highest (59/100): Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 addres.