#VU85654 Security features bypass in grub - CVE-2023-4001
Published: January 22, 2024
Vulnerability identifier: #VU85654
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2023-4001
CWE-ID: CWE-254
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
grub
grub
Software vendor:
GNU
GNU
Description
The vulnerability allows an attacker to bypass GRUB password protection feature.
The vulnerability exists due to an error in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker with physical access to the system can bypass the GRUB password protection feature on UEFI systems.
Remediation
Install updates from vendor's website.