CVE-2025-0622
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A flaw in the GRUB2 command/gpg component causes hooks created by loaded modules not to be removed when the module is unloaded. This allows an attacker to trigger a use-after-free vulnerability by calling a hook after its module has been freed. Successful exploitation could lead to arbitrary code execution and bypass of Secure Boot protections.
Risk Assessment
The risk involves bypassing Secure Boot, allowing an attacker to execute unauthorized code during the boot process, compromising system integrity and trust.
Recommendation
Immediately update GRUB2 to a version that includes the fix for removing hooks after module unload. Monitor vendor advisories for security patches.
Original NVD description (English source)
A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw allows an attacker to force grub2 to call the hooks once the module that registered it was unloaded, leading to a use-after-free vulnerability. If correctly exploited, this vulnerability may result in arbitrary code execution, eventually allowing the attacker to bypass secure boot protections.