7.5High

CVE-2023-4692Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution

grub; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Enterprise Linux 7 Published: 2023-10-25 13:27 (3 years ago)

Description

An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved.

Weakness (CWE): CWE-122 CWE-787

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
enterprise linux	8	—
enterprise linux	9	—
gnu	grub2	< 2.12
redhat	enterprise linux	8.0
Red Hat	Red Hat Enterprise Linux 7	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
—	grub	—

References and patches

RHSA-2024:2456 vendor-advisory
RHSA-2024:3184 vendor-advisory
https://access.redhat.com/security/cve/CVE-2023-4692 vdb-entryThird Party Advisory
RHBZ#2236613 issue-trackingIssue TrackingThird Party Advisory
https://dfir.ru/2023/10/03/cve-2023-4692-cve-2023-4693-vulnerabilities-in-the-grub-boot-manager/ ExploitThird Party Advisory
https://lists.gnu.org/archive/html/grub-devel/2023-10/msg00028.html Mailing List
https://seclists.org/oss-sec/2023/q4/37 Mailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUU42E7CPYLATX…
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIRJ5UZRXX2KLR…
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PERFILCHFEUGG3…
https://security.gentoo.org/glsa/202311-14
https://security.netapp.com/advisory/ntap-20231208-0002/

CPE matches (NVD) (3)

cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* < 2.12
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

CVSS score

7.5High

Source: redhat · CVSS 3.1

Attack vector: Local
Attack complexity: High
Privileges required: High
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

All scores (3)

cna	CVSS 3.1	7.5High
secalert@redhat.com	CVSS 3.1	7.5High
nvd	CVSS 3.1	7.8High

EPSS (chance of exploitation in 30 days)

0.54%

higher than 46% of all CVEs

CISA assessment (SSVC)

Exploitation: poc
Automatable: no
Technical impact: total

Timeline

ID reserved2023-08-31
Published2023-10-25 13:27
Reached IP-DB2026-10-24 23:53
Last updated2026-11-07 15:17

Assigned by (CNA): redhat
NVD status: Modified

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Red Hat Enterprise Linux

6.2Medium

CVE-2026-128886 13 hours ago

Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because th…

5.5Medium

CVE-2026-110330 14 hours ago

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8High

CVE-2026-110331 14 hours ago

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…

6.2Medium

CVE-2026-128987 14 hours ago

Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors a…

5.5Medium

CVE-2026-128885 14 hours ago

Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize

Red Hat Red Hat Enterprise Linux 10

A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…

8.8High

CVE-2026-18379 yesterday

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…