CVE-2023-4692: gnu grub2 Heap-based Buffer Overflow

Vulnerability summary

CVE-2023-4692 is a high (CVSS 7.8) Heap-based Buffer Overflow vulnerability in gnu grub2. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-10-2023
   PublishedVulnerability first disclosed.
2. 21-07-2026
   Last modifiedVulnerability information updated.

Description

An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.