Grub: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Summary

Product

Vulnerabilities 1

• Medium 6.8
  CVE-2023-4001

  Grub2: bypass the grub password protection feature

  An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external driv…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9.2 Extended Update Support Linux Ubuntu
  Jan 15, 2024

Revision history

1. 2024-01-29 #5

   Neue Updates von Oracle Linux aufgenommen

2. 2024-01-25 #4

   Neue Updates von Red Hat aufgenommen

3. 2024-01-24 #3

   Neue Updates von Red Hat aufgenommen

4. 2024-01-18 #2

   Neue Updates von Fedora aufgenommen

5. 2024-01-15 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2024-01-15
  https://github.com/advisories/GHSA-rr4v-xrwq-7rhx
• My DFIR Blog vom 2024-01-15
  https://dfir.ru/2024/01/15/cve-2023-4001-a-vulnerability-in-the-downstream-grub-boot-manager/
• Fedora Security Advisory FEDORA-2024-53D986312E vom 2024-01-18
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-53d986312e
• Fedora Security Advisory FEDORA-2024-633DC7E183 vom 2024-01-18
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-633dc7e183
• RedHat Security Advisory
  https://access.redhat.com/errata/RHSA-2024:0437
• Red Hat Security Advisory RHSA-2024:0456 vom 2024-01-25
  https://access.redhat.com/errata/RHSA-2024:0456
• Red Hat Security Advisory RHSA-2024:0468 vom 2024-01-25
  https://access.redhat.com/errata/RHSA-2024:0468
• Oracle Linux Security Advisory ELSA-2024-0468 vom 2024-01-30
  https://linux.oracle.com/errata/ELSA-2024-0468.html