Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update: grub #1199

Closed
dongsupark opened this issue Oct 6, 2023 · 0 comments · Fixed by flatcar/scripts#1264
Closed

update: grub #1199

dongsupark opened this issue Oct 6, 2023 · 0 comments · Fixed by flatcar/scripts#1264
Labels
advisory security advisory cvss/HIGH > 7 && < 9 assessed CVSS security security concerns

Comments

@dongsupark
Copy link
Member

dongsupark commented Oct 6, 2023 •
edited
Loading

Name: grub
CVEs: CVE-2023-4692, CVE-2023-4693
CVSSs: 7.8, 4.6
Action Needed: update to >= 2.06-r9

Summary:

  • CVE-2023-4692: There is an out-of-bounds write in grub-core/fs/ntfs.c. An attacker may leverage this vulnerability by presenting a specially crafted NTFS filesystem image leading to GRUB's heap metadata corruption. Additionally, in some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result arbitrary code execution and secure boot protection bypass may be achieved.
  • CVE-2023-4693: There is an out-of-bounds read at grub-core/fs/ntfs.c. A physically present attacker may leverage that by presenting a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack may allow sensitive data cached in memory or EFI variables values to be leaked presenting a high confidentiality risk.

refmap.gentoo: https://bugs.gentoo.org/915131
@dongsupark dongsupark added security security concerns advisory security advisory labels Oct 6, 2023
@dongsupark dongsupark moved this from 📝 Needs Triage to 🪵Backlog in Flatcar tactical, release planning, and roadmap Oct 6, 2023
@krnowak krnowak mentioned this issue Oct 12, 2023
Merged
2 tasks
@github-actions github-actions bot mentioned this issue Nov 9, 2023
Closed
@dongsupark dongsupark added the cvss/HIGH > 7 && < 9 assessed CVSS label Dec 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
advisory security advisory cvss/HIGH > 7 && < 9 assessed CVSS security security concerns
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

overlay sys-boot/grub: Update to 2.06-r9 flatcar/scripts
1 participant
@dongsupark