CVE-2023-4692: Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution
First published: Thu Aug 31 2023(Updated: )
An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ubuntu/grub2 | <2.12~ | 2.12~ |
| ubuntu/grub2-unsigned | <2.06-2ubuntu14.4 | 2.06-2ubuntu14.4 |
| ubuntu/grub2-unsigned | <2.06-2ubuntu14.4 | 2.06-2ubuntu14.4 |
| ubuntu/grub2-unsigned | <2.06-2ubuntu17.2 | 2.06-2ubuntu17.2 |
| ubuntu/grub2-signed | <1.187.6~20.04.1 | 1.187.6~20.04.1 |
| ubuntu/grub2-signed | <1.187.6 | 1.187.6 |
| ubuntu/grub2-signed | <1.193.2 | 1.193.2 |
| debian/grub2 | <=2.06-3~deb10u1<=2.06-3~deb11u5<=2.06-13<=2.06-13+deb13u1 | 2.06-3~deb10u4 2.06-3~deb11u6 2.06-13+deb12u1 2.12~rc1-12 |
| Gnu Grub2 | ||
| Redhat Enterprise Linux | =8.0 | |
| Redhat Enterprise Linux | =9.0 | |
| Gnu Grub2 | <2.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=2236613
- https://access.redhat.com/security/cve/CVE-2023-4692
- https://dfir.ru/2023/10/03/cve-2023-4692-cve-2023-4693-vulnerabilities-in-the-grub-boot-manager/
- https://lists.gnu.org/archive/html/grub-devel/2023-10/msg00028.html
- https://seclists.org/oss-sec/2023/q4/37
- https://launchpad.net/bugs/cve/CVE-2023-4692
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4692
- https://ubuntu.com/security/notices/USN-6410-1
- https://nvd.nist.gov/vuln/detail/CVE-2023-4692
- https://security-tracker.debian.org/tracker/CVE-2023-4692
- https://ubuntu.com/security/CVE-2023-4692
- https://lore.kernel.org/all/ZRxK8s4nQV2jBq%2F9@tomti.i.net-space.pl/
- https://access.redhat.com/errata/RHSA-2024:2456
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUU42E7CPYLATXOYVYNW6YTXXULAOV6L/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIRJ5UZRXX2KLR4IKBJEQUNGOCXMMDLY/
- https://security.gentoo.org/glsa/202311-14
- https://security.netapp.com/advisory/ntap-20231208-0002/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2241978
- https://lists.gnu.org/archive/html/grub-devel/2023-10/msg00029.html
- https://issues.redhat.com/browse/RHEL-11567
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PERFILCHFEUGG3OAMC6W55P6DDIBZK4Q/
Frequently Asked Questions
What is CVE-2023-4692?
CVE-2023-4692 is a vulnerability in grub2 that allows an attacker to perform out-of-bounds write/read via a specially crafted NTFS filesystem.
How does CVE-2023-4692 work?
An attacker can exploit this vulnerability by presenting a specially crafted NTFS filesystem image, causing heap metadata corruption in grub and potentially the UEFI firmware heap metadata.
Which software versions are affected by CVE-2023-4692?
The affected software versions include grub2 2.12~ and earlier, grub2-unsigned 2.06-2ubuntu14.4, grub2-unsigned 2.06-2ubuntu17.2, grub2-signed 1.187.6~20.04.1, and grub2-signed 1.193.2.
How can I fix CVE-2023-4692?
To fix CVE-2023-4692, upgrade to grub2 version 2.12~ or later, grub2-unsigned version 2.06-2ubuntu14.4 or later, grub2-unsigned version 2.06-2ubuntu17.2 or later, grub2-signed version 1.187.6~20.04.1 or later, or grub2-signed version 1.193.2 or later.
Where can I find more information about CVE-2023-4692?
You can find more information about CVE-2023-4692 on the MITRE CVE website, the GNU GRUB-devel mailing list, and the Ubuntu Security Notices.
- collector/oss-sec
- alias/CVE-2023-4692
- alias/CVE-2023-4693
- collector/launchpad-cve
- collector/usn-cve
- collector/security-tracker-debian
- collector/nvd-cve
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/author
- agent/severity
- agent/title
- agent/description
- agent/event
- agent/softwarecombine
- agent/references
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- package-manager/ubuntu
- package-manager/debian
- vendor/gnu
- canonical/gnu grub2
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- version/redhat enterprise linux/9.0