CVE-2023-4949 Memory Corruption Vulnerability in Grub-Legacy's XFS Implementation

2023-11-1016:57:03

CWE-190

CWE-119

Google

www.cve.org

cve-2023-4949

memory corruption

grub-legacy

xfs

exploit

local access

disk

external drive

8.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H

8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Grub-Legacy",
    "vendor": "Free Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "0.97",
        "status": "affected",
        "version": "0",
        "versionType": "git"
      }
    ]
  }
]