PT-2023-6116 · Grub2+10 · Grub2+10
Maxim Suhanov
·
Published
2023-10-03
·
Updated
2025-06-16
·
CVE-2023-4692
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Grub2 (affected versions not specified)
Description
An out-of-bounds write flaw was found in Grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to Grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Heap Based Buffer Overflow
Memory Corruption
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Grub2
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu