{"uuid": "f22f5e52-3396-4d25-a90d-616bb98d3e2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-40547", "type": "seen", "source": "https://t.me/hn_best_comments/20796", "content": "Re: CVE-2023-40547 \u2013 avoid incorrectly trusting HTTP h...\n        \nshim is an EFI bootloader commonly used by Linux distros that want to enable Secure Boot. Distros want an easy path to enabling Secure Boot using the default preloaded Microsoft signing key, rather than require users to enroll their own key. But Microsoft refuses to sign GPL bootloaders like grub in general, so shim was made to be able to be signed by the Microsoft key. (shim then implements its own separate signature verification of what it boots, based on a different key called the Machine Owner Key, MOK.)\n\nWhen you tell shim what EFI binary to boot, you can specify it as an HTTP URL. If you do this and the HTTP server is malicious, it can trigger an out-of-bounds write.\n\nHowever, usually you use it to boot a local second-stage bootloader like grub (hence the name \"shim\"), so it's unlikely to be a problem for most installs.\n\nRegardless, Secure Boot was built from the start to allow previously-signed binaries to be revoked via the DBX list - a list of signatures that can be loaded into the UEFI to make it reject binaries even if they have a valid signature. When (If) the signatures of old shim binaries with this bug are added to the list, you can update the list in your own machines. Updates may be distributed as capsule updates (via LVFS etc), or if you manage your SB keys and vars you can download and enroll the list from https://uefi.org/revocationlistfile\n        \nArnavion, 2 days ago", "creation_timestamp": "2026-07-29T12:01:07.082832Z"}