Shim: out-of-bounds read printing error messages

CVE-2023-40546

Summary

A notable flaw has been identified within Shim which arises during the creation of new ESL variables. When Shim encounters an error while creating a new variable, it attempts to log an error message. However, the parameters utilized by the logging function do not align correctly with the expected format string, which may lead to a system crash under specific conditions. This vulnerability poses a risk to various Red Hat products that rely on Shim for their secure boot functionality, potentially interrupting their operation and affecting overall system stability.

References