A critical vulnerability in the Shim Linux bootloader enables attackers to execute code and take control of a target system before the kernel is loaded, bypassing existing security mechanisms. Shim is a small open-source bootloader maintained by Red Hat that is designed to facilitate the Secure Boot process on computers using Unified Extensible Firmware Interface (UEFI). The tool is signed with a Microsoft key accepted by default on most UEFI motherboards that is used to verify the next stage of the boot process, typically loading the GRUB2 bootloader. Shim was created out of necessity to allow open-source projects such as Linux distributions to benefit from Secure Boot's advantages, such as preventing unauthorized or malicious code execution during boot, while still maintaining control over hardware. The new Shim flaw, tracked as CVE-2023-40547, was discovered by Microsoft's security researcher Bill Demirkapi, who first disclosed it on January 24, 2024. The bug resides in the httpboot.c source for Shim, which is used to boot a network image over HTTP.
"When retrieving files via HTTP or related protocols, shim attempts to allocate a buffer to store the received data," reads the commit to fix the bug in httpboot.c. "Unfortunately, this means getting the size from an HTTP header, which can be manipulated to specify a size that's smaller than the received data." "In this case, the code accidentally uses the header for the allocation but the protocol metadata to copy it from th...