Updated: 2024-11-21 22:35:13.818453
Description:
An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external drive such as a USB stick containing a file system with a duplicate UUID (the same as in the "/boot/" file system) can bypass the GRUB password protection feature on UEFI systems, which enumerate removable drives before non-removable ones. This issue was introduced in a downstream patch in Red Hat's version of grub2 and does not affect the upstream package.
| Links | NIST | CIRCL | RHEL | Ubuntu |
| Severity | Score | |
|---|---|---|
| CVSS Version 2.x | 0 | |
| CVSS Version 3.x | MEDIUM | 6.8 |
| OS name | Project name | Version | Score | Severity | Status | Errata | Last updated | Statement |
|---|---|---|---|---|---|---|---|---|
| AlmaLinux 9.2 ESU | grub2 | 2.06 | 6.8 | MEDIUM | Released | CLSA-2024:1712672279 | 2024-04-09 11:14:37 | A note for users: The grub2 stub configuration file /boot/efi/EFI/almalinux/grub.cfg should be remov... |
| CentOS 7 ELS | grub2 | 2.02 | 6.8 | MEDIUM | Ignored | 2024-01-25 08:43:08 | A note for users: The grub2 stub configuration file /boot/efi/EFI/almalinux/grub.cfg should be remov... | |
| CentOS 8.4 ELS | grub2 | 2.02 | 6.8 | MEDIUM | Ignored | 2024-01-25 08:43:08 | A note for users: The grub2 stub configuration file /boot/efi/EFI/almalinux/grub.cfg should be remov... | |
| CentOS 8.5 ELS | grub2 | 2.02 | 6.8 | MEDIUM | Ignored | 2024-01-25 08:43:10 | A note for users: The grub2 stub configuration file /boot/efi/EFI/almalinux/grub.cfg should be remov... |