Boot security is one of the most critical aspects of modern computing. If attackers can interfere during your machine's startup, they can potentially take control of everything that comes after. That's one reason why the software responsible for early boot operations - like Shim - has to be especially flawless. Unfortunately, in August 2023, a flaw tracked as CVE-2023-40551 was uncovered in Shim's handling of the MZ binary format, exposing systems to out-of-bounds read vulnerabilities. This post will walk you through what the issue is, why it matters, and how an attacker might be able to exploit it.

What is Shim and the MZ Binary Format?

Shim is a small, trusted piece of software that makes it possible for Linux distributions to boot on systems with Secure Boot enabled, before passing execution to the main bootloader like GRUB. It's responsible for verifying signatures and making sure that only authorized code runs at boot.

MZ binary format refers to legacy executables that start with the characters 'MZ' (for Mark Zbikowski), a remnant from DOS days. Shim can deal with these kinds of images during the boot process, which is where the vulnerability comes into play.

Explaining the Vulnerability (CVE-2023-40551)

Discovered and reported by security researchers, CVE-2023-40551 is a vulnerability in Shim's parser for MZ binaries. The problem occurs because Shim does not properly check boundaries when reading fields from MZ header structures. This results in an out-of-bounds read (OOB read), meaning the code tries to access memory outside the buffer it's meant to process.

Technical Breakdown and Code Example

The vulnerability sits in the parsing code for the MZ binary header, typically in files like pe.c in the Shim source tree. Specifically, Shim reads multiple fields from a buffer without proper length checks.

Simplified vulnerable code excerpt (for illustration)

uint16_t mz_magic = *(uint16_t *)buffer;
if (mz_magic == x5A4D) { // 'MZ'
    // ...
    uint16_t header_size = *(uint16_t *)(buffer + x08); // Potential OOB read!
    // process header_size, maybe without checking buffer size
}

What's wrong here?

- buffer + x08 might step outside the bounds of actual data loaded into memory, especially if the buffer is smaller than expected. Shim trusts the presence of these fields without confirming enough data is available, allowing an attacker to craft a tiny file that triggers an OOB read.

What can happen?

- Reading uninitialized or sensitive memory, leaking its contents if that memory gets reported or logged

How Could This Be Exploited?

The exploit scenario is tricky because it requires a way for an attacker to get Shim to process a malicious MZ executable during the boot process. In locked-down systems (like most Secure Boot deployments), this is pretty difficult. However, if an attacker gains physical access or tricks a system admin into booting a crafted bootloader, they might exploit this:

Reboot the machine: Boot from this media, causing Shim to parse and get tripped up by the file.

4. Result varies: Either the system crashes (denial of service), or sensitive bits of memory are exposed and can be exfiltrated via error reports/logs.

While the impact is limited by Secure Boot’s signature checks, specialized attacks (such as supply chain or insider attacks) might use this flaw as part of a broader exploitation chain.

- CVE-2023-40551 on Red Hat Security
- Shim GitHub Repository
- Shim 15.8 release details (with fix)
- Explainer: PE/COFF and MZ Binaries

Mitigation and Fix

The maintainers patched this bug in recent versions of Shim (15.8 and higher). The fix adds strict buffer boundary checks to all header reads, ensuring the file is big enough before accessing each field.

Fix pattern

if (buffer_length < expected_offset + sizeof(uint16_t)) {
    // fail gracefully, don't try to read
    return ERROR;
}

What to do

- Make sure your bootloaders and shims are up to date, especially if you have custom Secure Boot loader chains.

Conclusion

CVE-2023-40551 is a subtle but serious reminder: even ancient binary formats like MZ, handled in early boot, can hide critical vulnerabilities. Boot-time security software like Shim must be constantly reviewed and kept up to date to keep attackers out. Thankfully, the risk is now patched, but awareness is always the first step in securing modern computers—even during their very first moments after the power button is pressed.

Timeline

Published on: 01/29/2024 17:15:08 UTC
Last modified on: 04/25/2024 14:15:08 UTC