CLSA-2024-1712672279 grub2: Fix of CVE-2023-4001

Fix CVE-2023-4001: add --root-dev-only flag to force only search root dev the grub2 configuration file /boot/efi/EFI/almalinux/grub.cfg should be removed manually BEFORE grub2 updating...

DEBIAN-CVE-2024-2312

GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass...

GNU grub2 安全漏洞

GNU GRUB2 is a Linux system bootloader from the American GNU community. GNU GRUB2 suffers from a post-release reuse vulnerability that originates from a confusion in the program's instructions responsible for freeing memory. An attacker could exploit this vulnerability to cause a program crash,...

PT-2024-7967

Name of the Vulnerable Software and Affected Versions GRUB2 affected versions not specified Description The issue is related to GRUB2 not calling the module fini functions on exit, which leads to the peimage GRUB2 module leaving UEFI system table hooks after exit. This results in a use-after-free...

Updated grub2 packages fix security vulnerabilities

An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a...

Fedora: Security Advisory for grub2 (FEDORA-2024-c1fabee30e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CLSA-2024-1711036383 shim: Fix of 4 CVEs

Make this package installable only on a system having Cloudlinux signed components: grub2 and kernel - Update to shim-15.8 and fix the following CVEs: Resolves: CVE-2023-40546 Resolves: CVE-2023-40547 Resolves: СVE-2023-40548 Resolves: СVE-2023-40549 Resolves: CVE-2023-40550 Resolves:...

CLSA-2024-1711036211 Update of grub2

Make this package installable only on a system having Cloudlinux signed components: grub2 and kernel...

[SECURITY] Fedora 38 Update: grub2-2.06-116.fc38

The GRand Unified Bootloader GRUB is a highly configurable and customizable bootloader with modular architecture. It supports a rich variety of kernel formats, file systems, computer architectures and hardware devices...

UBUNTU-CVE-2024-26475

An issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fixed in v.5.8.8 allows a local attacker to cause a denial of service via the grubsfsreadextent function...

PT-2024-21395 · Radare2 · Radare2

Name of the Vulnerable Software and Affected Versions: radare2 versions 0.9.7 through 5.8.6 Description: An issue in radare2 allows a local attacker to cause a denial of service via the grub sfs read extent function. This issue enables a local attacker to disrupt the service. Recommendations: For...

[SECURITY] Fedora 39 Update: grub2-2.06-118.fc39

The GRand Unified Bootloader GRUB is a highly configurable and customizable bootloader with modular architecture. It supports a rich variety of kernel formats, file systems, computer architectures and hardware devices...

Fedora: Security Advisory (FEDORA-2024-097eb22907)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OESA-2024-1253 grub2 security update

GNU GRUB is a Multiboot boot loader. It was derived from GRUB, the GRand Unified Bootloader, which was originally designed and implemented by Erich Stefan Boleyn. Security Fixes: A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will...

rear: creates a world-readable initrd

A vulnerability has been identified in Relax-and-Recover ReaR, where the use of GRUBRESCUE=y results in the creation of an initrd that is readable by anyone. This flaw could potentially enable local attackers to obtain access to system secrets that are typically restricted to root privileges...

Medium: grub2

Issue Overview: The "/boot/efi/EFI/fedora/grub.cfg" configuration file allows an unprivileged user with physical access to a computer to bypass the GRUB password protection feature on many but not all UEFI-based systems. CVE-2023-4001 Affected Packages: grub2 Issue Correction: Run dnf update grub...

Medium: grub2

Issue Overview: The "/boot/efi/EFI/fedora/grub.cfg" configuration file allows an unprivileged user with physical access to a computer to bypass the GRUB password protection feature on many but not all UEFI-based systems. CVE-2023-4001 Affected Packages: grub2 Issue Correction: Run dnf update grub...

The vulnerability of the grub_cmd_chainloader() function, a loader for the Grub2 operating system, allows a hacker to gain access to confidential data and execute arbitrary code.

The vulnerability of the grubcmdchainloader function, a loader for the Grub2 operating system, is related to the repeated execution of the Chainloader command and the exploitation of the use-after-free vulnerability. Exploiting this vulnerability can allow an attacker to access confidential data...

The vulnerability of the Grub2 operating system loader, related to writing beyond the boundary during the processing of split HTTP headers, allows a hacker to cause a service failure.

The vulnerability of the Grub loader is related to writing beyond the boundaries during the processing of split HTTP headers. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the shim_lock component in the Grub2 operating system allows a hacker to break the trust chain of secure loading.

The vulnerability of the shimlock component in the Grub2 operating system is related to the loading of non-atomic files into the secure boot mechanism that supports shim. Exploiting this vulnerability can allow an attacker to break the trust chain of the secure boot mechanism...