Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grubusernameget function in grub-core/normal/auth.c or the (2) grubpasswordget function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.

grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.

A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots.

A flaw was found in the grub2-set-bootflag utility of grub2. When the utility is run under resource pressure (by setting RLIMIT), it can cause grub2 config files to be truncated leaving the system non-bootable on subsequent reboots.

A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in grub.cfg. This flaw affects grub2 2.06 and previous versions. This issue has been fixed in grub upstream but no version with the fix is currently released.

On Wed, Oct 04, 2023 at 05:13:57PM +0200, Solar Designer wrote: Hi,

A couple of issues in GRUB relevant to setups with Secure Boot got fixed:

https://lore.kernel.org/all/ZRxK8s4nQV2jBq%2F9 () tomti i net-space pl/

Daniel, I'd appreciate it if you post things like this to oss-security going forward. Thank you! Sure thing! I hope I can post to this ML without being member of it.

Daniel

Hello All,

Tavis Ormandy reported a flaw in grub2-set-bootflag utility of grub2.

grub-set-bootflag is a command line to set bootflags in GRUB's stored environment. This is a downstream utility which is shipped with Red Hat Enterprise Linux 8 and Fedora. A flaw was found in this application which would could allow a local attacker (someone having a local account on the system) to cause grub configuration files to be truncated. Whenever the machine was rebooted, grub would fail to read the configuration files and the system would be rendered unbootable.

More details and patches available in: https://bugzilla.redhat.com/showbug.cgi?id=1764925

-- Huzaifa Sidhpurwala / Red Hat Product Security