CVE-2023-4693: GNU GRUB2 Information Disclosure Flaw

CVE-2023-4693 Overview

An out-of-bounds read vulnerability has been identified in the NTFS filesystem driver of GNU GRUB2, the widely-used multiboot bootloader. This flaw allows a physically present attacker to craft a malicious NTFS file system image that can read arbitrary memory locations during the boot process. Successful exploitation enables the leakage of sensitive data cached in memory or EFI variable values, presenting a significant confidentiality risk to affected systems.

Critical Impact

Attackers with physical access can leverage crafted NTFS images to leak sensitive memory contents including cached credentials and EFI variables from systems running vulnerable GRUB2 versions.

Affected Products

• GNU GRUB2 (all versions prior to patched releases)
• Red Hat Enterprise Linux 8.0
• Red Hat Enterprise Linux 9.0

Discovery Timeline

• October 25, 2023 - CVE-2023-4693 published to NVD
• November 4, 2025 - Last updated in NVD database

Technical Details for CVE-2023-4693

Vulnerability Analysis

This vulnerability resides in GRUB2's NTFS filesystem driver implementation, which fails to properly validate boundaries when processing NTFS file system structures. The out-of-bounds read condition (CWE-125) occurs when the driver parses specially crafted NTFS metadata, allowing memory contents beyond the intended buffer boundaries to be accessed. Since GRUB2 operates during the pre-boot phase before operating system security controls are active, an attacker can potentially access sensitive information that would otherwise be protected, including EFI variables that may contain Secure Boot keys, platform configuration data, and other security-critical information cached in memory.

Root Cause

The root cause of this vulnerability is insufficient bounds checking in the NTFS filesystem driver code within GRUB2. When processing NTFS file system structures, the driver does not adequately validate that read operations remain within the allocated buffer boundaries. This allows carefully crafted NTFS metadata to trigger reads from memory locations outside the intended data structures, resulting in information disclosure.

Attack Vector

The attack requires physical access to the target system. An attacker must present a specially crafted NTFS file system image to the GRUB2 bootloader, typically via a malicious USB storage device or modified boot media. When GRUB2 attempts to read from this malicious NTFS partition during boot, the crafted file system structures trigger out-of-bounds memory reads. The attacker can then extract sensitive information from the leaked memory contents, potentially including EFI variables, cached credentials, or other security-sensitive data present in memory during the boot process.

The physical access requirement limits the attack surface, but in scenarios where attackers can access systems physically (such as shared workspaces, data centers, or stolen hardware), this vulnerability poses a serious confidentiality risk.

Detection Methods for CVE-2023-4693

Indicators of Compromise

• Unexpected USB devices or removable media connected during system boot sequences
• Modified or tampered boot partitions containing suspicious NTFS file systems
• Abnormal GRUB2 behavior or unexpected file system access attempts during boot
• Evidence of physical tampering with system boot media

Detection Strategies

• Implement Secure Boot and verify all bootloader components are signed with trusted keys
• Monitor for unauthorized changes to GRUB2 configuration files and boot partitions
• Deploy hardware security modules or TPM-based attestation to detect boot chain modifications
• Conduct regular integrity verification of bootloader binaries and configurations

Monitoring Recommendations

• Enable firmware logging to capture boot-time events and potential anomalies
• Implement physical security controls to detect and prevent unauthorized system access
• Use endpoint detection solutions capable of monitoring pre-boot environments where supported
• Audit removable media usage policies and restrict boot from external devices via BIOS/UEFI settings

How to Mitigate CVE-2023-4693

Immediate Actions Required

• Update GRUB2 to the latest patched version from your distribution vendor immediately
• Enable Secure Boot to prevent execution of unsigned or modified bootloaders
• Restrict physical access to affected systems and implement tamper-evident controls
• Disable boot from removable media in BIOS/UEFI settings where operationally feasible

Patch Information

Multiple Linux distributions have released security updates addressing this vulnerability. Red Hat has published security advisories RHSA-2024:2456 and RHSA-2024:3184 for Enterprise Linux. Fedora, Debian, and Gentoo have also released patched packages. Organizations should consult their respective distribution's security advisories and apply available updates. Additional details are available in the GNU GRUB Development Mailing List Post and the DFIR Blog Post.

Workarounds

• Enable Secure Boot with properly configured trust anchors to prevent loading of modified bootloaders
• Configure BIOS/UEFI to disable boot from USB devices and removable media
• Implement strong physical security controls to prevent unauthorized access to systems
• Consider using full-disk encryption to protect sensitive data at rest even if bootloader vulnerabilities are exploited

# Verify current GRUB2 version and check for available updates
grub2-install --version

# On Red Hat/CentOS/Fedora systems, update GRUB2
sudo dnf update grub2

# On Debian/Ubuntu systems, update GRUB2
sudo apt update && sudo apt upgrade grub-efi-amd64

# Regenerate GRUB2 configuration after update
sudo grub2-mkconfig -o /boot/grub2/grub.cfg