CVE-2023-4001: 
Alma Linux vulnerability analysis and mitigation

CVE-2023-4001 is an authentication bypass vulnerability discovered in GRUB (GRand Unified Bootloader) that affects the password protection feature. The vulnerability was discovered on April 3, 2023, and publicly disclosed on January 15, 2024. The flaw affects Red Hat's downstream version of GRUB2 and does not impact the upstream package. The vulnerability allows an attacker with physical access to bypass GRUB's password protection on UEFI-based systems (DFIR Blog).

The vulnerability exists in how GRUB uses the UUID of a device to search for the configuration file containing the password hash. On UEFI systems, the GRUB configuration is split between two files: one in the EFI System Partition and the main configuration file in the /boot volume. The vulnerability can be exploited when an attacker attaches an external drive (like a USB stick) containing a file system with a duplicate UUID matching the /boot file system. Due to how some UEFI systems enumerate removable drives before non-removable ones, GRUB may pick the wrong device, resulting in authentication bypass. The vulnerability has been assigned a CVSS v3.1 base score of 6.8 (Medium) with vector: AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD, Red Hat).

When successfully exploited, this vulnerability allows an attacker with physical access to bypass the GRUB password protection feature, potentially enabling them to modify boot parameters, boot unauthorized operating systems, or gain elevated privileges in the installed operating system. In some uncommon setups, the attack can be performed with physical access alone, without requiring unprivileged user access (DFIR Blog).

Red Hat has implemented a fix that adds a new argument to the 'search' command, which restricts the UUID scan to the block device used to launch the GRUB boot manager. This ensures that the /boot volume must reside on the same drive as the EFI System Partition. Users should remove the stub grub.cfg in their ESP by executing 'rm /boot/efi/EFI/redhat/grub.cfg' before applying the update, so it is regenerated with the correct search flags (Red Hat Bugzilla, DFIR Blog).