Ubuntu 22.04 LTS USN-6355-1 Moderate: GRUB2 Security Flaws

ubuntu

September 8, 2023

Several security issues were fixed in GRUB2.

Summary

Several security issues were fixed in GRUB2.

Software Description:

- grub2-signed: GRand Unified Bootloader

- grub2-unsigned: GRand Unified Bootloader

- shim: boot loader to chain-load signed boot loaders under Secure Boot

- shim-signed: Secure Boot chain-loading bootloader (Microsoft-signed binary)

Details:

Daniel Axtens discovered that specially crafted images could cause a

heap-based out-of-bonds write. A local attacker could possibly use

this to circumvent secure boot protections. (CVE-2021-3695)

Daniel Axtens discovered that specially crafted images could cause

out-of-bonds read and write. A local attacker could possibly use this

to circumvent secure boot protections. (CVE-2021-3696)

Daniel Axtens discovered that specially crafted images could cause

buffer underwrite which allows arbitrary data to be written to a heap.

A local attacker could possibly use this to circumvent secure

boot protections. (CVE-2021-3697)

It was discovered that GRUB2 confi...

Read the Full Advisory

Topics Covered

security advisory moderate security issue Ubuntu heap overflow bootloader GRUB2

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
   grub-efi-amd64                  2.06-2ubuntu14.1
   grub-efi-amd64-bin              2.06-2ubuntu14.1
   grub-efi-amd64-signed           1.187.3~22.04.1+2.06-2ubuntu14.1
   grub-efi-arm64                  2.06-2ubuntu14.1
   grub-efi-arm64-bin              2.06-2ubuntu14.1
   grub-efi-arm64-signed           1.187.3~22.04.1+2.06-2ubuntu14.1
   shim                            15.7-0ubuntu1
   shim-signed                     1.51.3+15.7-0ubuntu1

Ubuntu 20.04 LTS:
   grub-efi-amd64                  2.06-2ubuntu14.1
   grub-efi-amd64-bin              2.06-2ubuntu14.1
   grub-efi-amd64-signed           1.187.3~20.04.1+2.06-2ubuntu14.1
   grub-efi-arm64                  2.06-2ubuntu14.1
   grub-efi-arm64-bin              2.06-2ubuntu14.1
   grub-efi-arm64-signed           1.187.3~20.04.1+2.06-2ubuntu14.1
   shim                            15.7-0ubuntu1
   shim-signed                     1.40.9+15.7-0ubuntu1

In general, a standard system update will make all the necessary changes.