SB2023090801 - Ubuntu update for grub2-signed
Published: September 8, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2021-3695)
The vulnerability allows a local privileged user to bypass implemented security restrictions.
The vulnerability exists due to a boundary error when processing PNG grayscale images. A local privileged user can pass specially crafted PNG image to the application, trigger an out-of-bounds write error and potentially bypass secure boot protection mechanism.
2) Out-of-bounds write (CVE-ID: CVE-2021-3696)
The vulnerability allows a local privileged user to bypass implemented security restrictions.
The vulnerability exists due to a boundary error when handling Huffman tables in the PNG reader. A local privileged user can pass specially crafted PNG image to the application, trigger an out-of-bounds write error and potentially bypass secure boot protection mechanism.
3) Integer underflow (CVE-ID: CVE-2021-3697)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to integer underflow within the JPEG reader. A local privileged user can trigger an integer underflow and bypass secure boot protection mechanism.
4) Insecure Inherited Permissions (CVE-ID: CVE-2021-3981)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to incorrect default permissions for in grub.cfg file that are set by the application. A local user with access to the system can view contents of files and directories.
5) Integer underflow (CVE-ID: CVE-2022-28733)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer underflow when processing IP packets within the grub_net_recv_ip4_packets() function. A remote attacker can send specially crafted network traffic to the affected system, trigger an integer underflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Out-of-bounds write (CVE-ID: CVE-2022-28734)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing split HTTP headerst. A remote attacker can send specially crafted traffic to the affected system, trigger an out-of-bounds write and execute arbitrary code on the target system.
7) Insufficient verification of data authenticity (CVE-ID: CVE-2022-28735)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. A local privileged user can load unverified modules into GRUB and bypass secure boot protection mechanism.
8) Use-after-free (CVE-ID: CVE-2022-28736)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to a use-after-free error in the grub_cmd_chainloader() function in chainloader command. A local privileged user can trigger a use-after-free error and bypass secure boot protection mechanism.
9) Out-of-bounds write (CVE-ID: CVE-2022-28737)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to a boundary error in the handle_image() function when shim tries to load and execute crafted EFI executables. A local privileged user can trigger an out-of-bounds write error and bypass secure boot protection mechanism.
10) Out-of-bounds write (CVE-ID: CVE-2022-3775)
The vulnerability allows an attacker to crash the system.
The vulnerability exists due to a boundary error when rendering certain unicode sequences in grub2 font code. An attacker with physical access to device can trigger an out-of-bounds write and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.