Fedora has issued an advisory on March 20: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YSJAEGRR3XHMBBBKYOVMII4P34IXEYPE/ The fix is in the following patches from Fedora: 0349-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch 0350-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch 0351-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch Mageia 9 is also affected.
Source RPM: (none) => grub2-2.06-29.mga10.src.rpmCVE: (none) => CVE-2024-1048Whiteboard: (none) => MGA9TOO
Status comment: (none) => Patches available from Fedora
Different people have committed this, so assigning the bug globally.
Assignee: bugsquad => pkg-bugs
I think we need the patches from Fedora starting from 0342-fs-xfs-Fix-memory-leaks-in-XFS-module.patch to 0358-fs-ntfs-Make-code-more-readable.patch.
CVE: CVE-2024-1048 => CVE-2023-4692, CVE-2023-4693, CVE-2024-1048Summary: grub2 new security issue CVE-2024-1048 => grub2 new security issues CVE-2023-469[23] and CVE-2024-1048
Summary: grub2 new security issues CVE-2023-469[23] and CVE-2024-1048 => grub2 new security issues CVE-2023-469[23], CVE-2023-4001 and CVE-2024-1048CVE: CVE-2023-4692, CVE-2023-4693, CVE-2024-1048 => CVE-2023-4692, CVE-2023-4693, CVE-2023-4001, CVE-2024-1048
Suggested advisory: ======================== The updated packages fix security vulnerabilities: An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved. (CVE-2023-4692) An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk. (CVE-2023-4693) An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external drive such as a USB stick containing a file system with a duplicate UUID (the same as in the "/boot/" file system) can bypass the GRUB password protection feature on UEFI systems, which enumerate removable drives before non-removable ones. (CVE-2023-4001) A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not be removed and may fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks. (CVE-2024-1048) References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YSJAEGRR3XHMBBBKYOVMII4P34IXEYPE/ ======================== Updated packages in core/updates_testing: ======================== grub2-2.06-28.2.mga9 grub2-common-2.06-28.2.mga9 grub2-efi-2.06-28.2.mga9 grub2-emu-2.06-28.2.mga9 grub2-emu-modules-2.06-28.2.mga9 grub2-mageia-theme-2.06-28.2.mga9 from SRPM: grub2-2.06-28.2.mga9.src.rpm
Version: Cauldron => 9Assignee: pkg-bugs => qa-bugsWhiteboard: MGA9TOO => (none)Status: NEW => ASSIGNEDStatus comment: Patches available from Fedora => (none)Source RPM: grub2-2.06-29.mga10.src.rpm => grub2-2.06-28.1.mga9.src.rpm
CC: (none) => mageia
Keywords: (none) => advisory
RH mageia 9 x86_64, updated witout issues LC_ALL=C urpmi --auto --auto-update medium "QA Testing (32-bit)" is up-to-date updated medium "QA Testing (64-bit)" medium "Core Release (distrib1)" is up-to-date medium "Core Updates (distrib3)" is up-to-date medium "Nonfree Release (distrib11)" is up-to-date medium "Nonfree Updates (distrib13)" is up-to-date medium "Tainted Release (distrib21)" is up-to-date medium "Tainted Updates (distrib23)" is up-to-date medium "Core 32bit Release (distrib31)" is up-to-date medium "Core 32bit Updates (distrib32)" is up-to-date medium "Nonfree 32bit Release (distrib36)" is up-to-date medium "Tainted 32bit Release (distrib41)" is up-to-date medium "Tainted 32bit Updates (distrib42)" is up-to-date medium "BDK-Free-x86_64" is up-to-date medium "BDK-Free-noarch" is up-to-date medium "BDK-NonFree-x86_64" is up-to-date medium "MLO_core (MLO1)" is up-to-date medium "MLO_nonfree (MLO2)" is up-to-date medium "MLO_tainted (MLO3)" is up-to-date installing grub2-common-2.06-28.2.mga9.x86_64.rpm grub2-efi-2.06-28.2.mga9.x86_64.rpm grub2-2.06-28.2.mga9.x86_64.rpm grub2-mageia-theme-2.06-28.2.mga9.noarch.rpm from //home/katnatek/qa-testing/x86_64 Preparing... ################################################################################################## 1/4: grub2-efi ################################################################################################## 2/4: grub2-common ################################################################################################## 3/4: grub2 ################################################################################################## 4/4: grub2-mageia-theme ################################################################################################## 1/4: removing grub2-mageia-theme-2.06-28.1.mga9.noarch ################################################################################################## 2/4: removing grub2-2.06-28.1.mga9.x86_64 ################################################################################################## 3/4: removing grub2-common-2.06-28.1.mga9.x86_64 ################################################################################################## 4/4: removing grub2-efi-2.06-28.1.mga9.x86_64 ################################################################################################## I'll reboot and report again
RH mageia 9 x86_64 After reboot The grub menu load without issues The system loads without issue
CC: (none) => andrewsfarm
Whiteboard: (none) => MGA9-64-OK
A user in the French forum have an issue with this update that force him to repair grub with a live version of Mageia 9 : https://www.mageialinux-online.org/forum/topic-31414-0-323155-grub-2-plantage-apres-mise-a-jour.php#m323155 I'm not sure how his repositories are configured or the exact version of the update he made. I have asked him and wait for his answers. So please, wait before pushing this in Update.
CC: (none) => cyril.levet0780
Keywords: (none) => feedback
Hi, Anyway, in my own tests with 3 PCs (2 with UEFI and one with a BIOS), I did not have any problem with that update. Best regards, Nico.
Two of the vulnerabilities described in the advisory concern the NTFS filesystem driver. Have any of the tests so far been on systems multi-booting with a Windows NTFS system? I can't do it, as I don't do Windows if I can avoid it, and even then it's only in VirtualBox.
Installed and tested without issues. Tested on multiple systems, including several virtual machines. All systems booted OK and grub menu showed correctly. All systems are using kernel 6.6.22-desktop-1.mga9. Server System: Mageia 9, x86_64, Intel(R) Core(TM) i5-4590 CPU @ 3.30GHz. Workstation System: Mageia 9, x86_64, Plasma DE, AMD Ryzen 5 5600G with Radeon Graphics using amdgpu driver. VM 1 System: Mageia 9, x86_64, QEMU/KVM, LXQt DE, AMD Ryzen 5 5600G with Radeon Graphics, Radeon RX 6500 XT using amdgpu driver. VM 2 System: Mageia 9, x86_64, QEMU/KVM, Plasma DE, AMD Ryzen 5 5600G with Radeon Graphics, virtio display driver and SPICE client. VM 3 System: Mageia 9, aarch64, QEMU/KVM, WindowMaker DE, Cortex-A76 8 core emulation, virtio display driver and SPICE client.
(In reply to Cyril Levet from comment #6) > A user in the French forum have an issue with this update that force him to > repair grub with a live version of Mageia 9 : > https://www.mageialinux-online.org/forum/topic-31414-0-323155-grub-2- > plantage-apres-mise-a-jour.php#m323155 > > I'm not sure how his repositories are configured or the exact version of the > update he made. I have asked him and wait for his answers. > > So please, wait before pushing this in Update. The issue is in cauldron as the title says, so I think if we not find issues in the test for mageia 9 we proceed with the update
(In reply to Thomas Andrews from comment #8) > Two of the vulnerabilities described in the advisory concern the NTFS > filesystem driver. Have any of the tests so far been on systems > multi-booting with a Windows NTFS system? Sorry Mageia only in my 2 RH and in the VM
(In reply to katnatek from comment #10) > The issue is in cauldron as the title says, so I think if we not find issues > in the test for mageia 9 we proceed with the update The Cauldron in the title was a mistake by a moderator. It is Mageia 9 which is affected. But it seems that the user made a mistake by partially install grub2 through testing.
I tried to enlarge a Windows 7 VM and install Mageia in a dual-boot configuration, but it failed miserably, probably because the vdi was dynamically allocated. I'm removing the feedback flag because of comment 12. Validating because of all the successful tests, and because comment 12 seems to have solved the mystery put forth in comment 6.
CC: (none) => sysadmin-bugsKeywords: feedback => validated_update
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2024-0095.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED