All errata/p10/ALT-PU-2024-1607-2
ALT-PU-2024-1607-2

Package update grub in branch p10

Version2.06-alt17
Task#339331
Published2024-02-09
Max severityHIGH
Severity:

Closed issues (4)

BDU:2023-06578
MEDIUM5.3

Уязвимость компонента fs/ntfs.c загрузчика операционных систем Grub2, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2023-10-11Modified: 2025-03-05
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:N/A:N
References
BDU:2023-06822
MEDIUM5.3

Уязвимость компонента fs/ntfs.c загрузчика операционных систем Grub2, позволяющая нарушителю выполнить произвольный код

Published: 2023-10-17Modified: 2025-08-19
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
CVSS 2.0LOW 3.7
CVSS:2.0/AV:L/AC:H/Au:M/C:N/I:C/A:N
References
CVE-2023-4692
HIGH7.8

An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved.

Published: 2023-10-25Modified: 2025-11-04
CVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
CVE-2023-4693
MEDIUM4.6

An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk.

Published: 2023-10-25Modified: 2025-11-04
CVSS 3.xMEDIUM 4.6
CVSS:3.x/CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References

Closed bugs (3)

Bug #47850

grub-pc не устанавливает загрузчик на RAID, собранный из NVME дисков

Bug #48056

Конфиг файл grub'а 2.06-alt16 не работает с grub'ом 2.06-alt7 (только UEFI)

Bug #48343

Невозможность установки рядом с другими ОС