GRUB2: duplicate-UUID removable drive bypasses GRUB password protection on UEFI hosts

CVSS 6.8CVE-2023-4001Firmware, BMC & network fabriccurated

Impact

On Red Hat's grub2, the bootloader locates the config file holding the GRUB password hash by filesystem UUID. Someone who can attach a USB stick carrying a filesystem with the same UUID as /boot gets their config enumerated first on UEFI systems, which scan removable media before fixed disks, so the password prompt never protects the boot menu. From the GRUB shell the attacker edits the kernel command line of a GPU node - single-user boot, init override, disabled IOMMU or lockdown - which is the usual starting point for taking the host and anything cached on its local NVMe. This matters where racks are not single-tenant-locked: colocation suites, remote hands, hosted HPC. Upstream grub2 is not affected; this was introduced in a downstream Red Hat patch.

Who can reach it

Physical access to the node (CVSS AV:P) with the ability to plug in a USB device and reboot. No credentials needed - the point of the bug is that the GRUB password is not asked for.

What to do

Apply the Red Hat grub2 errata (RHSA-2024:0437 / 0456 / 0468 for the relevant RHEL 8 and 9 streams), then reboot the node for the new bootloader to take effect - so a drain-and-reboot pass across the fleet. Until then, rely on physical and chassis controls: lock racks, disable USB boot and removable-media enumeration in firmware setup, and set a BIOS/UEFI admin password, since the GRUB password alone cannot be trusted on these builds.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-4001 https://access.redhat.com/security/cve/CVE-2023-4001 https://access.redhat.com/errata/RHSA-2024:0437 https://bugzilla.redhat.com/show_bug.cgi?id=2224951

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.