Skip to content
Fencer Vulns
medium 6.8

CVE-2023-4001 json

Grub2: bypass the grub password protection feature

published 2024-01-15 2 y ago modified 2026-11-07 2 d ago also EUVD-2023-53896

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external drive such as a USB stick containing a file system with a duplicate UUID (the same as in the "/boot/" file system) can bypass the GRUB password protection feature on UEFI systems, which enumerate removable drives before non-removable ones. This issue was introduced in a downstream patch in Red Hat's version of grub2 and does not affect the upstream package.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 9 1:2.06-70.el9_3.2
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support 1:2.06-27.el9_0.16
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 1:2.06-61.el9_2.2
  • grub2 RHEL 9 1:2.06-70.el9_3.2
  • grub2-pc RHEL 9 1:2.06-70.el9_3.2
  • grub2-tools RHEL 9 1:2.06-70.el9_3.2
  • grub2-common RHEL 9 1:2.06-70.el9_3.2
  • grub2-efi-x64 RHEL 9 1:2.06-70.el9_3.2
  • grub2-ppc64le RHEL 9 1:2.06-70.el9_3.2
  • grub2-efi-aa64 RHEL 9 1:2.06-70.el9_3.2
  • grub2-tools-efi RHEL 9 1:2.06-70.el9_3.2

red hat advisories RHSA-2024:0437RHSA-2024:0456RHSA-2024:0468

  • grub2-pc AlmaLinux 9 1:2.06-70.el9_3.2.alma.1
  • grub2-tools AlmaLinux 9 1:2.06-70.el9_3.2.alma.1
  • grub2-common AlmaLinux 9 1:2.06-70.el9_3.2.alma.1
  • grub2-efi-x64 AlmaLinux 9 1:2.06-70.el9_3.2.alma.1
  • grub2-ppc64le AlmaLinux 9 1:2.06-70.el9_3.2.alma.1
  • grub2-efi-aa64 AlmaLinux 9 1:2.06-70.el9_3.2.alma.1
  • grub2-tools-efi AlmaLinux 9 1:2.06-70.el9_3.2.alma.1
  • grub2-pc-modules AlmaLinux 9 1:2.06-70.el9_3.2.alma.1

almalinux advisories ALSA-2024:0468

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-4001 updated cvss 6.8

grub2: bypass the GRUB password protection feature

  • Red Hat Enterprise Linux BaseOS (v. 9) grub2 2.06-70.el9_3.2, grub2-pc 2.06-70.el9_3.2, grub2-tools 2.06-70.el9_3.2, grub2-common 2.06-70.el9_3.2, grub2-efi-x64 2.06-70.el9_3.2, grub2-ppc64le 2.06-70.el9_3.2, +10 more
    fixed: vendor fix RHSA-2024:0468
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) grub2 2.06-27.el9_0.16, grub2-pc 2.06-27.el9_0.16, grub2-tools 2.06-27.el9_0.16, grub2-common 2.06-27.el9_0.16, grub2-efi-x64 2.06-27.el9_0.16, grub2-ppc64le 2.06-27.el9_0.16, +10 more
    fixed: vendor fix RHSA-2024:0437
  • Red Hat Enterprise Linux BaseOS EUS (v.9.2) grub2 2.06-61.el9_2.2, grub2-pc 2.06-61.el9_2.2, grub2-tools 2.06-61.el9_2.2, grub2-common 2.06-61.el9_2.2, grub2-efi-x64 2.06-61.el9_2.2, grub2-ppc64le 2.06-61.el9_2.2, +10 more
    fixed: vendor fix RHSA-2024:0456
  • Red Hat Enterprise Linux 8 grub2, grub2-pc, grub2-tools, grub2-common, grub2-efi-x64, grub2-ppc64le, +13 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8

Classification

Weakness
  • CWE-290 Authentication Bypass by Spoofing

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.