Alma Linux: CVE-2023-4001: Moderate: grub2 security update (ALSA-2024-0468)
Description
An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external drive such as a USB stick containing a file system with a duplicate UUID (the same as in the "/boot/" file system) can bypass the GRUB password protection feature on UEFI systems, which enumerate removable drives before non-removable ones. This issue was introduced in a downstream patch in Red Hat's version of grub2 and does not affect the upstream package.
Solution(s)
- alma-upgrade-grub2-common
- alma-upgrade-grub2-efi-aa64
- alma-upgrade-grub2-efi-aa64-cdboot
- alma-upgrade-grub2-efi-aa64-modules
- alma-upgrade-grub2-efi-x64
- alma-upgrade-grub2-efi-x64-cdboot
- alma-upgrade-grub2-efi-x64-modules
- alma-upgrade-grub2-pc
- alma-upgrade-grub2-pc-modules
- alma-upgrade-grub2-ppc64le
- alma-upgrade-grub2-ppc64le-modules
- alma-upgrade-grub2-tools
- alma-upgrade-grub2-tools-efi
- alma-upgrade-grub2-tools-extra
- alma-upgrade-grub2-tools-minimal
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center