CVE-2013-4577

Publication date 12 May 2014

Last updated 24 July 2024

A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the password_pbkdf2 directive in the file.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
grub2	21.04 hirsute	Fixed 2.00-20
	20.10 groovy	Fixed 2.00-20
	20.04 LTS focal	Fixed 2.00-20
	19.10 eoan	Fixed 2.00-20
	19.04 disco	Fixed 2.00-20
	18.10 cosmic	Fixed 2.00-20
	18.04 LTS bionic	Fixed 2.00-20
	17.10 artful	Fixed 2.00-20
	17.04 zesty	Fixed 2.00-20
	16.10 yakkety	Fixed 2.00-20
	16.04 LTS xenial	Fixed 2.00-20
	15.10 wily	Fixed 2.00-20
	15.04 vivid	Fixed 2.00-20
	14.10 utopic	Fixed 2.00-20
	14.04 LTS trusty	Fixed 2.00-20
	13.10 saucy	Ignored
	13.04 raring	Ignored
	12.10 quantal	Ignored
	12.04 LTS precise	Ignored
	10.04 LTS lucid	Ignored

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
grub2	Other: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=safer_grub_cfg_perms.diff.gz;att=1;bug=632598

CVE-2013-4577

Status

Patch details

References

Other references