What is CVE-2023-40551?

CVE-2023-40551 is a medium-severity vulnerability in Fedoraproject Fedora, classified under Out-of-bounds Read. CVSS score: 5.1/10. Published 2024-01-29.

How severe is CVE-2023-40551?

Medium severity. CVSS v3 base score is 5.1 out of 10.

Is CVE-2023-40551 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Out-of-bounds Read in Fedoraproject Fedora

CVE-2023-40551

A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.

Vulnerability class: Buffer Overflow

EPSS: 0.004 (32.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H.

Affected products

Fedoraproject Fedora — versions 39
Red Hat Enterprise Linux 7 — versions 0:15.8-3.el7, 0:15.8-1.el7
Red Hat Enterprise Linux 8 — versions 0:15.8-4.el8_9
Red Hat Enterprise Linux 8.2 Advanced Update Support — versions 0:15.8-2.el8_2
Red Hat Enterprise Linux 8.2 Telecommunications Update Service — versions 0:15.8-2.el8_2
Red Hat Enterprise Linux 8.2 Update Services For Sap Solutions — versions 0:15.8-2.el8_2
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support — versions 0:15.8-2.el8_4
Red Hat Enterprise Linux 8.4 Telecommunications Update Service — versions 0:15.8-2.el8_4
Red Hat Enterprise Linux 8.4 Update Services For Sap Solutions — versions 0:15.8-2.el8_4
Red Hat Enterprise Linux 8.6 Extended Update Support — versions 0:15.8-2.el8_6

Weakness classification (CWE)

CWE-125 — Out-of-bounds Read

Public proof-of-concept exploits

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vdb-entry, Vendor Advisory)

Frequently asked questions

What is CVE-2023-40551?: CVE-2023-40551 is a medium-severity vulnerability in Fedoraproject Fedora, classified under Out-of-bounds Read. CVSS score: 5.1/10. Published 2024-01-29.
How severe is CVE-2023-40551?: Medium severity. CVSS v3 base score is 5.1 out of 10.
Is CVE-2023-40551 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.