MGASA-2024-0095 - Updated grub2 packages fix security vulnerabilities

Publication date: 28 Mar 2024
URL: https://advisories.mageia.org/MGASA-2024-0095.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2023-4692,
     CVE-2023-4693,
     CVE-2023-4001,
     CVE-2024-1048

An out-of-bounds write flaw was found in grub2's NTFS filesystem driver.
This issue may allow an attacker to present a specially crafted NTFS
filesystem image, leading to grub's heap metadata corruption. In some
circumstances, the attack may also corrupt the UEFI firmware heap
metadata. As a result, arbitrary code execution and secure boot
protection bypass may be achieved. (CVE-2023-4692)
An out-of-bounds read flaw was found on grub2's NTFS filesystem driver.
This issue may allow a physically present attacker to present a
specially crafted NTFS file system image to read arbitrary memory
locations. A successful attack allows sensitive data cached in memory or
EFI variable values to be leaked, presenting a high Confidentiality
risk. (CVE-2023-4693)
An authentication bypass flaw was found in GRUB due to the way that GRUB
uses the UUID of a device to search for the configuration file that
contains the password hash for the GRUB password protection feature. An
attacker capable of attaching an external drive such as a USB stick
containing a file system with a duplicate UUID (the same as in the
"/boot/" file system) can bypass the GRUB password protection feature on
UEFI systems, which enumerate removable drives before non-removable
ones. (CVE-2023-4001)
A flaw was found in the grub2-set-bootflag utility of grub2. After the
fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file
with the new grubenv content and rename it to the original grubenv file.
If the program is killed before the rename operation, the temporary file
will not be removed and may fill the filesystem when invoked multiple
times, resulting in a filesystem out of free inodes or blocks.
(CVE-2024-1048)

References:
- https://bugs.mageia.org/show_bug.cgi?id=32997
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YSJAEGRR3XHMBBBKYOVMII4P34IXEYPE/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4692
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4693
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4001
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1048

SRPMS:
- 9/core/grub2-2.06-28.2.mga9