CVE search results

1 – 10 of 34 results

Detailed view

Sort by:

CVE-2024-56738

Medium priority

Needs evaluation

GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Not affected	Not affected	Not affected
grub2-signed	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
grub2-unsigned	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2024-56737

Medium priority

Needs evaluation

GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem.

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Not affected	Not affected	Not affected
grub2-signed	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
grub2-unsigned	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2024-2312

Medium priority

Some fixes available 4 of 8

GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Not affected	Not affected	Not affected
grub2-signed	Fixed	Not affected	Not affected	Not affected	Not affected
grub2-unsigned	Fixed	Not affected	Not affected	Not affected	Not affected

CVE-2024-1048

Medium priority

Not affected

A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program...

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Not affected	Not affected	Not affected
grub2-signed	Not affected	Not affected	Not affected	Not affected	Not affected
grub2-unsigned	Not affected	Not affected	Not affected	Not affected	Not affected

CVE-2023-4001

Medium priority

Ignored

An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable...

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Not affected	Not affected	Not affected
grub2-signed	Not affected	Not affected	Not affected	Not affected	Not affected
grub2-unsigned	Not affected	Not affected	Not affected	Not affected	Not affected

CVE-2023-4693

Medium priority

Some fixes available 9 of 15

An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful...

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Not affected	Not affected	Not affected
grub2-signed	Fixed	Fixed	Fixed	Needs evaluation	Needs evaluation
grub2-unsigned	Not affected	Fixed	Fixed	Needs evaluation	Needs evaluation

CVE-2023-4692

Medium priority

Some fixes available 12 of 17

An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the...

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Not affected	Not affected	Not affected
grub2-signed	Fixed	Fixed	Fixed	Needs evaluation	Needs evaluation
grub2-unsigned	Fixed	Fixed	Fixed	Needs evaluation	Needs evaluation

CVE-2022-28736

Medium priority

Some fixes available 6 of 12

There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When...

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Not affected	Not affected	Not affected
grub2-signed	Not affected	Fixed	Fixed	Fixed	Vulnerable
grub2-unsigned	Not affected	Fixed	Fixed	Fixed	Vulnerable

CVE-2022-28735

Medium priority

Some fixes available 6 of 12

The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules to be loaded in GRUB2 breaking the secure boot trust-chain.

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Not affected	Not affected	Not affected
grub2-signed	Not affected	Fixed	Fixed	Fixed	Vulnerable
grub2-unsigned	Not affected	Fixed	Fixed	Fixed	Vulnerable

CVE-2022-28734

Medium priority

Some fixes available 6 of 12

Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing...

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Not affected	Not affected	Not affected
grub2-signed	Not affected	Fixed	Fixed	Fixed	Vulnerable
grub2-unsigned	Not affected	Fixed	Fixed	Fixed	Vulnerable

Export to JSON

Results by page:

Search CVE reports