An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external drive such as a USB stick containing a file system with a duplicate UUID (the same as in the "/boot/" file system) can bypass the GRUB password protection feature on UEFI systems, which enumerate removable drives before non-removable ones. This issue was introduced in a downstream patch in Red Hat's version of grub2 and does not affect the upstream package.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-555 advisory.

    The /boot/efi/EFI/fedora/grub.cfg configuration file allows an unprivileged user with physical access to     a computer to bypass the GRUB password protection feature on many (but not all) UEFI-based systems.
    (CVE-2023-4001)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-633dc7e183 advisory.

    Combined update for several fixes as well as security fix for CVE-2023-4001

    ```     Mon Jan 15 2024 Nicolas Frayer <nfrayer@redhat.com> - 2.06-114     grub-core/commands: add flag to only search root dev     Resolves: #2223437     Resolves: #2224951     Resolves: #2258096     Resolves: CVE-2023-4001

    Sat Jan 13 2024 Hector Martin <marcan@fedoraproject.org> - 2.06-113     Switch memdisk compression to lzop

    Thu Jan 11 2024 Daan De Meyer <daan.j.demeyer@gmail.com> - 2.06-112     Don't obsolete the tools package with minimal

    Mon Jan 8 2024 Nicolas Frayer <nfrayer@redhat.com> - 2.06-111     xfs: some bios systems with /boot partition created with     xfsprog < 6.5.0 can't boot with one of the xfs upstream patches     Resolves: #2254370

    Tue Dec 19 2023 Nicolas Frayer <nfrayer@redhat.com> - 2.06-110     normal: fix prefix when loading modules     Resolves: #2209435     Resolves: #2173015

    Tue Dec 12 2023 leo sandoval <lsandova@redhat.com> - 2.06-109     chainloader: remove device path debug message     ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-53d986312e advisory.

    Combined update for several fixes as well as security fix for CVE-2023-4001

    ```     Mon Jan 15 2024 Nicolas Frayer nfrayer@redhat.com - 2.06-116     grub-core/commands: add flag to only search root dev     Resolves: #2223437     Resolves: #2224951     Resolves: #2258096     Resolves: CVE-2023-4001

    Sat Jan 13 2024 Hector Martin marcan@fedoraproject.org - 2.06-115     Switch memdisk compression to lzop

    Thu Jan 11 2024 Daan De Meyer daan.j.demeyer@gmail.com - 2.06-114     Don't obsolete the tools package with minimal

    Mon Jan 8 2024 Nicolas Frayer <nfrayer@redhat.com> - 2.06-113     xfs: some bios systems with /boot partition created with     xfsprog < 6.5.0 can't boot with one of the xfs upstream patches     Resolves: #2254370

    Tue Dec 19 2023 Nicolas Frayer <nfrayer@redhat.com> - 2.06-112     normal: fix prefix when loading modules     Resolves: #2209435     Resolves: #2173015

    Tue Dec 12 2023 leo sandoval <lsandova@redhat.com> - 2.06-111     chainloader: remove device path debug message

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-0468 advisory.

    [2.06-70.0.2.2]
    - search command: add flag to only search root dev
    - Resolves: #CVE-2023-4001

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:0468 advisory.

  - An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to     search for the configuration file that contains the password hash for the GRUB password protection     feature. An attacker capable of attaching an external drive such as a USB stick containing a file system     with a duplicate UUID (the same as in the /boot/ file system) can bypass the GRUB password protection     feature on UEFI systems, which enumerate removable drives before non-removable ones. This issue was     introduced in a downstream patch in Red Hat's version of grub2 and does not affect the upstream package.
    (CVE-2023-4001)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0456 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: bypass the GRUB password protection feature (CVE-2023-4001)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0437 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: bypass the GRUB password protection feature (CVE-2023-4001)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0468 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: bypass the GRUB password protection feature (CVE-2023-4001)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191608	Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2024-555)	Nessus	Amazon Linux Local Security Checks	medium
189986	Fedora 38 : grub2 (2024-633dc7e183)	Nessus	Fedora Local Security Checks	medium
189984	Fedora 39 : grub2 (2024-53d986312e)	Nessus	Fedora Local Security Checks	medium
189754	Oracle Linux 9 : grub2 (ELSA-2024-0468)	Nessus	Oracle Linux Local Security Checks	medium
189622	AlmaLinux 9 : grub2 (ALSA-2024:0468)	Nessus	Alma Linux Local Security Checks	medium
189588	RHEL 9 : grub2 (RHSA-2024:0456)	Nessus	Red Hat Local Security Checks	medium
189564	RHEL 9 : grub2 (RHSA-2024:0437)	Nessus	Red Hat Local Security Checks	medium
189559	RHEL 9 : grub2 (RHSA-2024:0468)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2023-4001

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium