CVE-2023-4692 Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution
An out-of-bounds write in GRUB2's NTFS driver allows attackers to execute arbitrary code and bypass Secure Boot via a crafted filesystem image.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-4692?
CVE-2023-4692 is a high-severity memory corruption vulnerability in Redhat Enterprise Linux, published on 25 Oct 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved.
Which versions are affected by CVE-2023-4692?
It affects 2 products.
Products include Gnu Grub2, Redhat Enterprise Linux.
How do I fix CVE-2023-4692?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-4692 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4692 exists.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2024-56737 Memory corruption in GRUB2
- CVE-2022-28733 Integer underflow in grub_net_recv_ip4_packets
- CVE-2022-28734 Out-of-bounds write when handling split HTTP headers
- CVE-2025-61662 Grub2: missing unregister call for gettext command may lead to use-after-free
- CVE-2024-45782 Grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382)
Sources
Also known as AZL-31686, AZL-34795, BELL-CVE-2023-4692, CLSA-2023-1700161520, CLSA-2023-1700164193, CLSA-2024-1707226462 and 4 more.