1. Forum
  2. Usenet
  3. LINUX.GENTOO.ANNOUNCE

  • [gentoo-announce] [ GLSA 202311-14 ] GRUB: Multiple Vulnerabilities

    From [email protected]@21:1/5 to All on Sat Nov 25 12:30:02 2023
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 202311-14
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    https://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Severity: High
    Title: GRUB: Multiple Vulnerabilities
    Date: November 25, 2023
    Bugs: #881413, #915187
    ID: 202311-14

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    Multiple vulnerabilities have been discoverd in GRUB, which may lead to
    secure boot circumvention or code execution.

    Background
    ==========

    GNU GRUB is a multiboot boot loader used by most Linux systems.

    Affected packages
    =================

    Package Vulnerable Unaffected
    ------------- ------------ ------------
    sys-boot/grub < 2.06-r9 >= 2.06-r9

    Description
    ===========

    Multiple vulnerabilities have been discovered in GRUB. Please review the
    CVE identifiers referenced below for details.

    Impact
    ======

    Please review the referenced CVE identifiers for details.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All GRUB users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=sys-boot/grub-2.06-r9"

    References
    ==========

    [ 1 ] CVE-2022-2601
    https://nvd.nist.gov/vuln/detail/CVE-2022-2601
    [ 2 ] CVE-2022-3775
    https://nvd.nist.gov/vuln/detail/CVE-2022-3775
    [ 3 ] CVE-2023-4692
    https://nvd.nist.gov/vuln/detail/CVE-2023-4692
    [ 4 ] CVE-2023-4693
    https://nvd.nist.gov/vuln/detail/CVE-2023-4693

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

    https://security.gentoo.org/glsa/202311-14

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users' machines is of utmost
    importance to us. Any security concerns should be addressed to [email protected] or alternatively, you may file a bug at https://bugs.gentoo.org.

    License
    =======

    Copyright 2023 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    https://creativecommons.org/licenses/by-sa/2.5
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmVh2FMACgkQFMQkOaVy +9m1yA/8CSCLvTXqOvMOVRQd9O1Dw0haCvrEt7WldDqx9LFyRL0n+mCNyn8satgG lS/SaNCC2h6ATXTp2dMRnumTF6IFr6F01qU68/d4Ybriu34TyTL+w1/MdyBgarbI n1yPB0IZEmyRkdZgprkbUzHMqZ6ZrsdwZvfoXSY9N4qTBgJDwFXZD/KZZfKgTGPV l7yu146LZO/EbG2lqr6YhYJmLfqwG6PbwXCj47IgHyD0fP2rrUxbtu3aZpBSQi+g gC6XKBPrb2HMNrrKwg8/W2/Tit5alRgZokRBmRAt2QWU5gQyW1bG8Q2uWS3oULyi +v3CE/oH86oindRB9LwkHFnvmF66/np7ccKQDW4F1QSYQo4wF+48ki/auNgM4UJ4 Ydo0cemsL0MNibfSMpDx72vaY7rwAxJ/+LUUfHnpMDWO2/8mQcUUxmfeSbFtHHHY otyn/nF0lxDdXzJnRUUxoGinX/xQr1o0x1t/XZiF+BcwnldjUKzSaeSQqhev2geb FCvLTHpqbFmti0kqOLoW6MtGN+Ea22roS0EkTB0ZGbbU9mHN21qSAeFSurLxHQ/+ QHkvLyBbiUqCe0b2NkQ0m3oeW6FEggEGFqIp8MnhtLfbSzPYGuMps2m1SPxoQv88 Mip8hQZr1GOYSMxJ/VbnV8T/flIdUYU1UYKzNTiQ3xdC7lakbXw=
    =Y22e
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)