Summary
It was discovered that a specially crafted file system image could cause a
heap-based out-of-bounds write. A local attacker could potentially use this
to perform arbitrary code execution bypass and bypass secure boot
protections. (CVE-2023-4692)
It was discovered that a specially crafted file system image could cause an
out-of-bounds read. A physically-present attacker could possibly use this
to leak sensitive information to the GRUB pager. (CVE-2023-4693)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | grub2-signed | 1.187.6~20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | grub2-signed | 1.187.6 |
| Ubuntu · 22.04 LTS 22.04:LTS | grub2-unsigned | 2.06-2ubuntu14.4 |
Vulnerabilities 2
-
High 7.5
Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution
An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the …
-
Medium 5.3
Grub2: out-of-bounds read at fs/ntfs.c
An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cach…