CVE-2025-0624
HighCVSS 7.6Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
In Grub2, during the network boot process, when searching for the configuration file, data from a user-controlled environment variable is copied into an internal buffer using grub_strcpy() without considering the variable's length during buffer allocation, resulting in an out-of-bounds write. This could allow remote code execution from the same network segment where Grub is searching for boot information, bypassing Secure Boot protections.
Risk Assessment
The organization faces the risk of remote code execution during network boot, potentially bypassing Secure Boot mechanisms and allowing unauthorized code execution, which could lead to persistent system compromise.
Recommendation
Immediately update Grub2 to a patched version that addresses this vulnerability. Until the update is applied, restrict access to the boot network and monitor traffic in the network segment used for booting.
Other vulnerabilities in Grub2
See all- CVE-2022-3775High
The vulnerability in grub2 involves improper validation of the width and height of glyphs when rendering certain unicode sequences. This can lead to an out-of-bounds write in grub2's heap, resulting in memory corruption and availability issues.
- CVE-2015-8370High
Multiple integer underflows in Grub2 versions 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the grub_username_get and grub_password_get functions.
- CVE-2025-61664Medium
A Use After Free vulnerability has been identified in the GRUB2 bootloader's normal module. The flaw occurs because the normal_exit command is not properly unregistered when its module is unloaded. An attacker can invoke the command after module removal, causing access to freed memory.
- CVE-2025-61663Medium
A Use-after-Free vulnerability has been found in the GRUB2 bootloader's 'normal' command. The flaw occurs because the command is not properly unregistered when the module is unloaded, allowing an attacker to access invalid memory locations. Successful exploitation leads to system instability and a complete crash.
- CVE-2025-54770Medium
A Use-after-Free vulnerability has been found in the GRUB2 bootloader's network module. The flaw is caused by improper unregistration of the net_set_vlan command when the module is unloaded from memory. An attacker can exploit this to cause system instability and a complete crash.
- CVE-2025-0686Medium
A flaw in the romfs module of GRUB2 allows integer overflow during buffer size calculation based on user-controlled filesystem geometry parameters. A crafted filesystem can cause a smaller-than-expected buffer allocation, leading to out-of-bounds writes in grub_romfs_read_symlink() and potentially arbitrary code execution.
- CVE-2025-0685Medium
A buffer overflow vulnerability was found in the jfs filesystem module of GRUB2. The grub_jfs_lookup_symlink() function writes beyond the allocated buffer when a specially crafted jfs filesystem is used. This can corrupt critical internal GRUB data and potentially lead to arbitrary code execution.
- CVE-2025-0684Medium
A flaw in GRUB2's reiserfs module allows integer overflow during symlink buffer size calculation, leading to heap out-of-bounds write and potential arbitrary code execution.
- CVE-2025-0678High
A flaw in GRUB2's squash4 module improperly checks integer overflows when determining internal buffer sizes from filesystem geometry. A crafted filesystem can cause a smaller buffer allocation, leading to a heap-based out-of-bounds write during data reading. This could allow arbitrary code execution and bypass Secure Boot protections.
- CVE-2024-45778Medium
A stack overflow vulnerability was found in the BFS file system support in GRUB2. A crafted BFS filesystem image can trigger an uncontrolled loop, causing GRUB2 to crash.
Original NVD description (English source)
A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to by-pass secure boot protections.