CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-1048 – Grub2: grub2-set-bootflag can be abused by local (pseudo-)users
https://notcve.org/view.php?id=CVE-2024-1048
A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not be removed and may fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks. Se encontró una falla en la utilidad grub2-set-bootflag de grub2. Después de la corrección de CVE-2019-14865, grub2-set-bootflag creará un archivo temporal con el nuevo contenido de grubenv y le cambiará el nombre al archivo grubenv original. • http://www.openwall.com/lists/oss-security/2024/02/06/3 https://access.redhat.com/errata/RHSA-2024:2456 https://access.redhat.com/errata/RHSA-2024:3184 https://access.redhat.com/security/cve/CVE-2024-1048 https://bugzilla.redhat.com/show_bug.cgi?id=2256827 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XRZQCVZ3XOASVFT6XLO7F2ZXOLOHIJZQ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YSJAEGRR3XHMBBBKYOVMII4P34IXEYPE https: • CWE-459: Incomplete Cleanup •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-4001 – Grub2: bypass the grub password protection feature
https://notcve.org/view.php?id=CVE-2023-4001
An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external drive such as a USB stick containing a file system with a duplicate UUID (the same as in the "/boot/" file system) can bypass the GRUB password protection feature on UEFI systems, which enumerate removable drives before non-removable ones. This issue was introduced in a downstream patch in Red Hat's version of grub2 and does not affect the upstream package. Se encontró un fallo de omisión de autenticación en GRUB debido a la forma en que GRUB usa el UUID de un dispositivo para buscar el archivo de configuración que contiene el hash de contraseña para la función de protección de contraseña de GRUB. Un atacante capaz de conectar una unidad externa, como una memoria USB que contenga un sistema de archivos con un UUID duplicado (el mismo que en el sistema de archivos "/boot/") puede omitir la función de protección con contraseña GRUB en los sistemas UEFI, que enumeran unidades extraíbles. antes que los no removibles. • http://www.openwall.com/lists/oss-security/2024/01/15/3 https://access.redhat.com/errata/RHSA-2024:0437 https://access.redhat.com/errata/RHSA-2024:0456 https://access.redhat.com/errata/RHSA-2024:0468 https://access.redhat.com/security/cve/CVE-2023-4001 https://bugzilla.redhat.com/show_bug.cgi?id=2224951 https://dfir.ru/2024/01/15/cve-2023-4001-a-vulnerability-in-the-downstream-grub-boot-manager https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject& • CWE-290: Authentication Bypass by Spoofing •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-4692 – Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution
https://notcve.org/view.php?id=CVE-2023-4692
An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved. Se encontró una falla de escritura fuera de los límites en el controlador del sistema de archivos NTFS de grub2. • https://access.redhat.com/errata/RHSA-2024:2456 https://access.redhat.com/errata/RHSA-2024:3184 https://access.redhat.com/security/cve/CVE-2023-4692 https://bugzilla.redhat.com/show_bug.cgi?id=2236613 https://dfir.ru/2023/10/03/cve-2023-4692-cve-2023-4693-vulnerabilities-in-the-grub-boot-manager https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUU42E7CPYLATXOYVYNW6YTXXULAOV6L https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.or • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 1CVE-2023-4693 – Grub2: out-of-bounds read at fs/ntfs.c
https://notcve.org/view.php?id=CVE-2023-4693
An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk. Se encontró una falla de lectura fuera de los límites en el controlador del sistema de archivos NTFS de grub2. Este problema puede permitir que un atacante físicamente presente presente una imagen del sistema de archivos NTFS especialmente manipulada para leer ubicaciones de memoria arbitrarias. • https://access.redhat.com/errata/RHSA-2024:2456 https://access.redhat.com/errata/RHSA-2024:3184 https://access.redhat.com/security/cve/CVE-2023-4693 https://bugzilla.redhat.com/show_bug.cgi?id=2238343 https://dfir.ru/2023/10/03/cve-2023-4692-cve-2023-4693-vulnerabilities-in-the-grub-boot-manager https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUU42E7CPYLATXOYVYNW6YTXXULAOV6L https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.or • CWE-125: Out-of-bounds Read •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3775 – grub2: Heap based out-of-bounds write when redering certain unicode sequences
https://notcve.org/view.php?id=CVE-2022-3775
When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded. Al representar ciertas secuencias Unicode, el código de fuente de grub2 no se valida correctamente si el ancho y alto del glifo informado están restringidos dentro del tamaño del mapa de bits. Como consecuencia, un atacante puede crear una entrada que provocará una escritura fuera de los límites en el montón de grub2, lo que provocará daños en la memoria y problemas de disponibilidad. • https://access.redhat.com/security/cve/cve-2022-3775 https://security.gentoo.org/glsa/202311-14 https://access.redhat.com/security/cve/CVE-2022-3775 https://bugzilla.redhat.com/show_bug.cgi?id=2138880 • CWE-787: Out-of-bounds Write •