CLSA-2024-1713864372 Update of grub2

Improve Xen detection so we don't set GRUBENABLEBLSCFG=false for HVM domU guests...

SUSE CVE-2024-2312

GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass...

CLSA-2024-1711036383 shim: Fix of 4 CVEs

Make this package installable only on a system having Cloudlinux signed components: grub2 and kernel - Update to shim-15.8 and fix the following CVEs: Resolves: CVE-2023-40546 Resolves: CVE-2023-40547 Resolves: СVE-2023-40548 Resolves: СVE-2023-40549 Resolves: CVE-2023-40550 Resolves:...

CLSA-2024-1711036211 Update of grub2

Make this package installable only on a system having Cloudlinux signed components: grub2 and kernel...

The vulnerability of the shim_lock component in the Grub2 operating system allows a hacker to break the trust chain of secure loading.

The vulnerability of the shimlock component in the Grub2 operating system is related to the loading of non-atomic files into the secure boot mechanism that supports shim. Exploiting this vulnerability can allow an attacker to break the trust chain of the secure boot mechanism...

grub2 security vulnerability

grub2 is a Linux system boot program from the American GNU community. A security vulnerability exists in grub2, which stems from the fact that if the program is terminated before a rename operation, temporary files will not be deleted and may fill the filesystem on multiple invocations, resulting...

PT-2024-1698 · Grub2 +5 · Grub2 +5

Name of the Vulnerable Software and Affected Versions: grub2 affected versions not specified Description: A flaw in the grub2-set-bootflag utility of grub2 can lead to a denial of service. The issue arises when the program creates a temporary file with new grubenv content and is killed before...

The vulnerability of the password-based protection mechanism of Grub2, a loader for operating systems, allows a hacker to bypass the established access control measures.

The vulnerability of the password-based authentication mechanism of the Grub2 operating system’s loader is related to the ability to bypass authentication through spoofing. Exploiting this vulnerability can allow an attacker to circumvent the established access control measures...

CLSA-2023-1700164193 grub2: Fix of CVE-2023-4692

CVE-2023-4692: ntfs: checks to ensure that NTFS drive's sector numbers are never written beyond the boundary...

CLSA-2023-1700161520 grub2: Fix of CVE-2023-4692

CVE-2023-4692: ntfs: checks to ensure that NTFS drive's sector numbers are never written beyond the boundary...

Grub2: out-of-bounds read at fs/ntfs.c

...

OESA-2023-1720 grub2 security update

GNU GRUB is a Multiboot boot loader. It was derived from GRUB, the GRand Unified Bootloader, which was originally designed and implemented by Erich Stefan Boleyn. Security Fixes: An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a...

UBUNTU-CVE-2023-4693

An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to...

grub2 buffer error vulnerability

grub2 is a Linux system boot program from the American GNU community. A security vulnerability exists in grub2 that stems from an out-of-bounds read vulnerability in the NTFS file system driver...

grub2 buffer error vulnerability

grub2 is a Linux system boot program from the American GNU community. A security vulnerability exists in grub2 that stems from an out-of-bounds write vulnerability in the NTFS file system driver...

PT-2023-6116 · Grub2 +10 · Grub2 +10

Name of the Vulnerable Software and Affected Versions: Grub2 affected versions not specified Description: An out-of-bounds write flaw was found in Grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to Grub's heap metadata...

AZL-27552 CVE-2022-28734 affecting package grub2 for versions less than 2.06-12

Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NULL byte past the buffer. It's...

AZL-27551 CVE-2022-28735 affecting package grub2 for versions less than 2.06-12

The GRUB2's shimlock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules to be loaded in GRUB2 breaking the secure boot trust-chain...

AZL-34791 CVE-2022-28736 affecting package grub2 for versions less than 2.06-14

There's a use-after-free vulnerability in grubcmdchainloader function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If a...

CVE-2022-28736

There's a use-after-free vulnerability in grubcmdchainloader function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If a...