Linux Distros Hit by RCE Vulnerability in Shim Bootloader

Linux shim (CVE-2023-40547) contains an out-of-bounds write in its HTTP response parsing that can lead to remote code execution and full system compromise on UEFI systems; major distributions (Red Hat, Ubuntu, Debian, SUSE) are affected and Red Hat released shim 15.8 to address the issue. Exploitation vectors include man‑in‑the‑middle attacks against HTTP/PXE boot, local modification of EFI variables or EFI partitions, or chain‑loading a vulnerable shim during network boot; vendors disagree on exploitability and no active in-the-wild exploitation is reported in the document.