grub2-2.02-0.87.14.0.3.el7.AXS7

The GRand Unified Bootloader (GRUB) is a highly configurable and customizable
bootloader with modular architecture. It supports a rich variety of kernel
formats, file systems, computer architectures and hardware devices.

Security Fix(es):

* CVE-2023-4692: ntfs: checks to ensure that NTFS drive's sector numbers are
never written beyond the boundary
* CVE-2023-4693: ntfs: fix an out-of-bounds read flaw on NTFS filesystem driver

CVE(s):
CVE-2023-4692
An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved.
CVE-2023-4693
An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk.