CVE catalog

CVE-2023-4001

grub2: CVE-2023-4001

Severity: Medium · CVSS 6.8CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Jan 1, 2023, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.54% · Oct 27, 2026

An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external drive such as a USB stick containing a file system with a duplicate UUID (the same as in the "/boot/" file system) can bypass the GRUB password protection feature on UEFI systems, which enumerate removable drives before non-removable ones. This issue was introduced in a downstream patch in Red Hat's version of grub2 and does not affect the upstream package.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	grub2	sid	`2.14-4`	not affected
Debian	grub2	forky	`2.14-4`	not affected
Debian	grub2	trixie	`2.12-9+deb13u2`	not affected
Debian	grub2	bookworm	`2.06-13+deb12u2`	not affected
Debian	grub2	bookworm-security	`2.06-13+deb12u1`	not affected
Ubuntu	grub2-signed	pro	`1.22`	vulnerable
Ubuntu	grub2-signed	pro	`1.23`	vulnerable
Ubuntu	grub2-signed	pro	`1.24`	vulnerable
Ubuntu	grub2-signed	pro	`1.25`	vulnerable
Ubuntu	grub2-signed	pro	`1.26`	vulnerable
Ubuntu	grub2-signed	pro	`1.27`	vulnerable
Ubuntu	grub2-signed	pro	`1.30`	vulnerable
Ubuntu	grub2-signed	pro	`1.31`	vulnerable
Ubuntu	grub2-signed	pro	`1.32`	vulnerable
Ubuntu	grub2-signed	pro	`1.33`	vulnerable
Ubuntu	grub2-signed	pro	`1.34`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.1`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.2`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.3`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.4`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.5`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.6`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.7`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.8`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.9`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.13`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.14`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.16`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.17`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.18`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.20`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.22`	vulnerable
Ubuntu	grub2-signed	pro	`1.34.24`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	grub2	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	grub2	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	grub2	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	grub2	source	bookworm	`Not affected`	unimportant	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[grub2]Not affected
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub2-common]Not affected
Source package: [grub2]
Details (6)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-common]Not affected
Source package: [grub2]
Details (6)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-coreboot]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-coreboot-bin]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-coreboot-dbg]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi]Not affected
Source package: [grub2]
Details (6)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-amd64]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-amd64-bin]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-amd64-dbg]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-amd64-signed-template]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-arm64]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-arm64-bin]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-arm64-dbg]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-arm64-signed-template]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-ia32]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-ia32-bin]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-ia32-dbg]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-emu]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-emu-dbg]Not affected
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm

Next results

Observed: Oct 28, 2026, 5:52:36 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]