CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-4692 – Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution
https://notcve.org/view.php?id=CVE-2023-4692
04 Oct 2023 — An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved. Se encontró una falla de escritura fuera de los límites en el controlador del sistema de archivos NTFS de grub2. • https://access.redhat.com/errata/RHSA-2024:2456 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 1CVE-2023-4693 – Grub2: out-of-bounds read at fs/ntfs.c
https://notcve.org/view.php?id=CVE-2023-4693
04 Oct 2023 — An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk. Se encontró una falla de lectura fuera de los límites en el controlador del sistema de archivos NTFS de grub2. Este problema puede permitir que un atacante físicam... • https://access.redhat.com/errata/RHSA-2024:2456 • CWE-125: Out-of-bounds Read •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3775 – grub2: Heap based out-of-bounds write when redering certain unicode sequences
https://notcve.org/view.php?id=CVE-2022-3775
16 Nov 2022 — When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded. Al representar ciertas secuencias Unicode, el código de fuente de grub2 no se valida correctamente si el ancho y alto del gli... • https://access.redhat.com/security/cve/cve-2022-3775 • CWE-787: Out-of-bounds Write •
CVSS: 8.6EPSS: 0%CPEs: 12EXPL: 0CVE-2022-2601 – grub2: Buffer overflow in grub_font_construct_glyph() can lead to out-of-bound write and possible secure boot bypass
https://notcve.org/view.php?id=CVE-2022-2601
16 Nov 2022 — A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism. Se encontró un desbordamiento del búfer en grub_font_construct_glyph(). Una fuente pf2 manipulada maliciosamente puede provocar un desbordamien... • https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 5.1EPSS: 0%CPEs: 4EXPL: 1CVE-2021-46705 – grub2-once uses fixed file name in /var/tmp
https://notcve.org/view.php?id=CVE-2021-46705
16 Mar 2022 — A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1. Una vulnerabilidad de Archivos Temporales no Seguros en grub-once de grub2 en SUSE Linux Enterprise Server 15 SP4, openSUSE Factory permite a atacantes locales truncar archivos arbitrario... • https://bugzilla.suse.com/show_bug.cgi?id=1190474 • CWE-377: Insecure Temporary File •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-3981 – grub2: Incorrect permission in grub.cfg allow unprivileged user to read the file content
https://notcve.org/view.php?id=CVE-2021-3981
08 Mar 2022 — A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in grub.cfg. This flaw affects grub2 2.06 and previous versions. This issue has been fixed in grub upstream but no version with the fix is currently released. Se ha encontrado un fallo en grub2 en el que su archivo de ... • http://www.openwall.com/lists/oss-security/2024/01/15/3 • CWE-276: Incorrect Default Permissions •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3418
https://notcve.org/view.php?id=CVE-2021-3418
15 Mar 2021 — If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature validation. The booted kernel will think it was booted in secureboot mode and will implement lockdown, yet it could have been tampered. This flaw is a reintroduction of CVE-2020-15705 and only affects grub2 versions prior to 2.06 and upstream and distributions using the shim_lock mechanism. Si los certificados que firmaron grub están instalados en db, grub puede ser arrancado d... • https://bugzilla.redhat.com/show_bug.cgi?id=1933757 • CWE-281: Improper Preservation of Permissions •
CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 0CVE-2020-27779 – grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled
https://notcve.org/view.php?id=CVE-2020-27779
03 Mar 2021 — A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo en grub2 en versiones anteriores a 2.06. El comando cutmem no respeta el bloqueo de s... • https://bugzilla.redhat.com/show_bug.cgi?id=1900698 • CWE-285: Improper Authorization •
CVSS: 7.6EPSS: 0%CPEs: 20EXPL: 0CVE-2020-25647 – grub2: Out-of-bounds write in grub_usb_device_initialize()
https://notcve.org/view.php?id=CVE-2020-25647
03 Mar 2021 — A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo en grub2 en versiones anterior... • https://bugzilla.redhat.com/show_bug.cgi?id=1886936 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 0CVE-2020-27749 – grub2: Stack buffer overflow in grub_parser_split_cmdline()
https://notcve.org/view.php?id=CVE-2020-27749
03 Mar 2021 — A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution which could also circumvent Secure Boot protections. The highest th... • https://bugzilla.redhat.com/show_bug.cgi?id=1899966 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •