Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-4692

Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

grub

  • 2.12 to < *unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 1:2.02-156.el8 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 1:2.06-77.el9 to < *unaffected

Red Hat Red Hat Enterprise Linux 7

Default version status: affected

References