Threat Intelligence Database

A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability

The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Security Fix(es): * grub2: grub-core/gettext: Integer overflow leads to Heap OOB Write. (CVE-2024-45777) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.

Multiple security vulnerabilities have been identified in the grub2 boot loader packages used by Red Hat Enterprise Linux 10. These include integer overflows leading to heap out-of-bounds (OOB) read and write, use-after-free conditions, and a security bypass related to the dump command under secure boot. Red Hat has released an updated grub2 package to address these issues. The update is rated as having a moderate security impact. Users of affected Red Hat Enterprise Linux 10 variants are advised to apply the update as detailed in the vendor advisory.

Multiple security vulnerabilities have been identified in the grub2 boot loader packages used in Red Hat Enterprise Linux 9. These include heap out-of-bounds writes during JPEG parsing, missing checks for failed memory allocation, integer overflows leading to heap out-of-bounds reads and writes, double refcount decrements, use-after-free conditions, and other memory corruption issues. The vulnerabilities affect various components such as JPEG reader, command extensions, gettext, UFS and HFS+ file systems, GPG command, and symlink handling. Red Hat has released a security update addressing these issues with a moderate security impact rating.

A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the grub_romfs_read_symlink() may cause out-of-bounds writes when the calling grub_disk_read() function. This issue may be leveraged to corrupt grub's internal critical data and can result in arbitrary code execution by-passing secure boot protections.

A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the direct_read() will perform a heap based out-of-bounds write during data reading. This flaw may be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution, by-passing secure boot protections.

An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk.

MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2023-4693