Amazon Linux AMI update for grub2

Published: 2024-09-10

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2024-1048 CVE-2019-14865
CWE-ID	CWE-399 CWE-267
Exploitation vector	Local
Public exploit	N/A
Vulnerable software	Amazon Linux AMI Operating systems & Components / Operating system grub2 Operating systems & Components / Operating system package or component
Vendor	Amazon Web Services

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Resource management error

EUVDB-ID: #VU87164

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-1048

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in the grub2-set-bootflag utility of grub2. The grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not be removed and may fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks.

Mitigation

Update the affected packages:

aarch64:
    grub2-efi-aa64-ec2-2.06-61.amzn2023.0.10.aarch64
    grub2-emu-modules-2.06-61.amzn2023.0.10.aarch64
    grub2-efi-aa64-2.06-61.amzn2023.0.10.aarch64
    grub2-debuginfo-2.06-61.amzn2023.0.10.aarch64
    grub2-efi-aa64-cdboot-2.06-61.amzn2023.0.10.aarch64
    grub2-tools-minimal-debuginfo-2.06-61.amzn2023.0.10.aarch64
    grub2-tools-extra-2.06-61.amzn2023.0.10.aarch64
    grub2-tools-extra-debuginfo-2.06-61.amzn2023.0.10.aarch64
    grub2-tools-minimal-2.06-61.amzn2023.0.10.aarch64
    grub2-tools-debuginfo-2.06-61.amzn2023.0.10.aarch64
    grub2-emu-2.06-61.amzn2023.0.10.aarch64
    grub2-emu-debuginfo-2.06-61.amzn2023.0.10.aarch64
    grub2-tools-2.06-61.amzn2023.0.10.aarch64
    grub2-debugsource-2.06-61.amzn2023.0.10.aarch64

noarch:
    grub2-efi-x64-modules-2.06-61.amzn2023.0.10.noarch
    grub2-pc-modules-2.06-61.amzn2023.0.10.noarch
    grub2-common-2.06-61.amzn2023.0.10.noarch
    grub2-efi-aa64-modules-2.06-61.amzn2023.0.10.noarch

src:
    grub2-2.06-61.amzn2023.0.10.src

x86_64:
    grub2-efi-x64-cdboot-2.06-61.amzn2023.0.10.x86_64
    grub2-emu-modules-2.06-61.amzn2023.0.10.x86_64
    grub2-pc-2.06-61.amzn2023.0.10.x86_64
    grub2-tools-minimal-2.06-61.amzn2023.0.10.x86_64
    grub2-tools-debuginfo-2.06-61.amzn2023.0.10.x86_64
    grub2-emu-debuginfo-2.06-61.amzn2023.0.10.x86_64
    grub2-tools-minimal-debuginfo-2.06-61.amzn2023.0.10.x86_64
    grub2-efi-x64-2.06-61.amzn2023.0.10.x86_64
    grub2-tools-extra-2.06-61.amzn2023.0.10.x86_64
    grub2-tools-extra-debuginfo-2.06-61.amzn2023.0.10.x86_64
    grub2-tools-2.06-61.amzn2023.0.10.x86_64
    grub2-efi-x64-ec2-2.06-61.amzn2023.0.10.x86_64
    grub2-tools-efi-2.06-61.amzn2023.0.10.x86_64
    grub2-debuginfo-2.06-61.amzn2023.0.10.x86_64
    grub2-emu-2.06-61.amzn2023.0.10.x86_64
    grub2-tools-efi-debuginfo-2.06-61.amzn2023.0.10.x86_64
    grub2-debugsource-2.06-61.amzn2023.0.10.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

grub2: before 2.06-61

CPE2.3

External links

https://alas.aws.amazon.com/AL2023/ALAS-2024-546.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Privilege Defined With Unsafe Actions

EUVDB-ID: #VU97100