CVE-2023-4001

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-4001
An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external drive such as a USB stick containing a file system with a duplicate UUID (the same as in the "/boot/" file system) can bypass the GRUB password protection feature on UEFI systems, which enumerate removable drives before non-removable ones. This issue was introduced in a downstream patch in Red Hat's version of grub2 and does not affect the upstream package.

6.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/01/15/3 Mailing List
https://access.redhat.com/errata/RHSA-2024:0437
https://access.redhat.com/errata/RHSA-2024:0456
https://access.redhat.com/errata/RHSA-2024:0468
https://access.redhat.com/security/cve/CVE-2023-4001 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2224951 Issue Tracking Vendor Advisory
https://dfir.ru/2024/01/15/cve-2023-4001-a-vulnerability-in-the-downstream-grub-boot-manager/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OBADMKHQLJOBA32Q7XPNSYMVHVAFDCB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHLZQ47HM64NDOHMHYO7VIJFYD5ZPPYN/
https://security.netapp.com/advisory/ntap-20240216-0006/
Configurations

Configuration 1 (hide)

cpe:2.3:a:gnu:grub2:-:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
History

16 Feb 2024, 13:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240216-0006/ -

05 Feb 2024, 04:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHLZQ47HM64NDOHMHYO7VIJFYD5ZPPYN/ -

05 Feb 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OBADMKHQLJOBA32Q7XPNSYMVHVAFDCB/ -

25 Jan 2024, 20:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0437 -
  • () https://access.redhat.com/errata/RHSA-2024:0456 -
  • () https://access.redhat.com/errata/RHSA-2024:0468 -

23 Jan 2024, 19:29

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/01/15/3 - () http://www.openwall.com/lists/oss-security/2024/01/15/3 - Mailing List
References () https://access.redhat.com/security/cve/CVE-2023-4001 - () https://access.redhat.com/security/cve/CVE-2023-4001 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2224951 - () https://bugzilla.redhat.com/show_bug.cgi?id=2224951 - Issue Tracking, Vendor Advisory
References () https://dfir.ru/2024/01/15/cve-2023-4001-a-vulnerability-in-the-downstream-grub-boot-manager/ - () https://dfir.ru/2024/01/15/cve-2023-4001-a-vulnerability-in-the-downstream-grub-boot-manager/ - Third Party Advisory
CVSS v2 : unknown
v3 : 5.6 		v2 : unknown
v3 : 6.8
CPE cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:a:gnu:grub2:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
First Time Redhat enterprise Linux
Fedoraproject
Redhat
Gnu
Gnu grub2
Fedoraproject fedora

16 Jan 2024, 01:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/01/15/3 -

15 Jan 2024, 12:15

Type Values Removed Values Added
Summary
  • (es) Se encontró un fallo de omisión de autenticación en GRUB debido a la forma en que GRUB usa el UUID de un dispositivo para buscar el archivo de configuración que contiene el hash de contraseña para la función de protección de contraseña de GRUB. Un atacante capaz de conectar una unidad externa, como una memoria USB que contenga un sistema de archivos con un UUID duplicado (el mismo que en el sistema de archivos "/boot/") puede omitir la función de protección con contraseña GRUB en los sistemas UEFI, que enumeran unidades extraíbles. antes que los no removibles. Este problema se introdujo en un parche posterior en la versión de grub2 de Red Hat y no afecta el paquete anterior.
References
  • () https://dfir.ru/2024/01/15/cve-2023-4001-a-vulnerability-in-the-downstream-grub-boot-manager/ -

15 Jan 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-15 11:15

Updated : 2024-02-16 13:15

NVD link : CVE-2023-4001

Mitre link : CVE-2023-4001

CVE.ORG link : CVE-2023-4001

JSON object : View

Products Affected

redhat

  • enterprise_linux

gnu

  • grub2

fedoraproject

  • fedora
CWE
CWE-290

Authentication Bypass by Spoofing