Summary
The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.
Security Fix(es):
* grub2: grub2-set-bootflag can be abused by local (pseudo-)users (CVE-2024-1048)
* grub2: Out-of-bounds write at fs/ntfs.c may lead to unsigned code execution (CVE-2023-4692)
* grub2: out-of-bounds read at fs/ntfs.c (CVE-2023-4693)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | grub2-common | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-efi-aa64 | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-efi-aa64-cdboot | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-efi-aa64-modules | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-efi-ia32 | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-efi-ia32-cdboot | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-efi-ia32-modules | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-efi-x64 | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-efi-x64-cdboot | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-efi-x64-modules | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-pc | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-pc-modules | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-ppc64le | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-ppc64le-modules | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-tools | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-tools-efi | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-tools-extra | 1:2.02-156.el8.alma.1 |
| AlmaLinux · 8 | grub2-tools-minimal | 1:2.02-156.el8.alma.1 |
Vulnerabilities 3
-
High 7.5
Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution
An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the …
-
Medium 5.3
Grub2: out-of-bounds read at fs/ntfs.c
An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cach…
-
Low 3.3
Grub2: grub2-set-bootflag can be abused by local (pseudo-)users
A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename o…
References
-
report
https://access.redhat.com/security/cve/CVE-2023-4692
-
report
https://access.redhat.com/security/cve/CVE-2023-4693
-
report
https://access.redhat.com/security/cve/CVE-2024-1048
-
report
https://bugzilla.redhat.com/2236613
-
report
https://bugzilla.redhat.com/2238343
-
report
https://bugzilla.redhat.com/2256827
-
advisory
https://errata.almalinux.org/8/ALSA-2024-3184.html