The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external drive such as a USB stick containing a file system with a duplicate UUID (the same as in the "/boot/" file system) can bypass the GRUB password protection feature on UEFI systems, which enumerate removable drives before non-removable ones. This issue was introduced in a downstream patch in Red Hat's version of grub2 and does not affect the upstream package.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grub2-pc-modulesUpgrade grub2-ppc64leUpgrade grub2-ppc64le-modulesUpgrade grub2-efi-aa64-modulesUpgrade grub2-commonUpgrade grub2-efi-x64-modulesUpgrade grub2-tools-minimalUpgrade grub2-tools-efiUpgrade grub2-tools-extraUpgrade grub2-efi-x64-cdbootUpgrade grub2-toolsUpgrade grub2-pcUpgrade grub2-efi-aa64-cdbootUpgrade grub2-efi-x64Upgrade grub2-efi-aa64 | Jan 29, 2024 | Jan 15, 2024 |
| Amazon_linux_2023 | — | Upgrade grub2-toolsUpgrade grub2-emuUpgrade grub2-emu-modulesUpgrade grub2-tools-efiUpgrade grub2-tools-minimal-debuginfoUpgrade grub2-efi-aa64Upgrade grub2-efi-x64-cdbootUpgrade grub2-debugsourceUpgrade grub2-commonUpgrade grub2-emu-debuginfoUpgrade grub2-tools-efi-debuginfoUpgrade grub2-efi-x64Upgrade grub2-tools-minimalUpgrade grub2-tools-extra-debuginfoUpgrade grub2-tools-debuginfoUpgrade grub2-efi-x64-modulesUpgrade grub2-efi-aa64-ec2Upgrade grub2-efi-aa64-cdbootUpgrade grub2-debuginfoUpgrade grub2-pcUpgrade grub2-efi-x64-ec2Upgrade grub2-tools-extraUpgrade grub2-efi-aa64-modulesUpgrade grub2-pc-modules | Feb 17, 2025 | Jan 9, 2024 |
| Centos_linux | — | Upgrade grub2-toolsUpgrade grub2-efi-aa64-modulesUpgrade grub2-tools-efi-debuginfoUpgrade grub2-tools-debuginfoUpgrade grub2-debugsourceUpgrade grub2-emu-debuginfoUpgrade grub2-tools-extraUpgrade grub2-tools-extra-debuginfoUpgrade grub2-tools-minimalUpgrade grub2-commonUpgrade grub2-tools-efiUpgrade grub2-efi-x64-modulesUpgrade grub2-efi-x64Upgrade grub2-efi-x64-cdbootUpgrade grub2-pc-modulesUpgrade grub2-tools-minimal-debuginfoUpgrade grub2-pcUpgrade grub2-debuginfo | Jan 26, 2024 | Jan 15, 2024 |
| Oracle_linux | — | Upgrade grub2-efi-aa64-modulesUpgrade grub2-efi-x64-modulesUpgrade grub2-efi-aa64Upgrade grub2-pc-modulesUpgrade grub2-tools-extraUpgrade grub2-commonUpgrade grub2-toolsUpgrade grub2-tools-efiUpgrade grub2-tools-minimalUpgrade grub2-efi-aa64-cdbootUpgrade grub2-efi-x64-cdbootUpgrade grub2-efi-x64Upgrade grub2-pc | Jan 30, 2024 | Jan 9, 2024 |
| Redhat_linux | — | Upgrade grub2-efi-x64-cdbootUpgrade grub2-ppc64le-modulesUpgrade grub2-pcUpgrade grub2-tools-minimal-debuginfoUpgrade grub2-debuginfoUpgrade grub2-pc-modulesUpgrade grub2-tools-extra-debuginfoUpgrade grub2-emu-debuginfoUpgrade grub2-tools-efi-debuginfoUpgrade grub2-debugsourceUpgrade grub2-tools-extraUpgrade grub2-tools-minimalUpgrade grub2-tools-debuginfoUpgrade grub2-efi-x64Upgrade grub2-efi-x64-modulesUpgrade grub2-commonUpgrade grub2-tools-efiUpgrade grub2-efi-aa64-modulesUpgrade grub2-tools | Jan 26, 2024 | Jan 15, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 3, 2025 | Jan 15, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub