CVE-2025-4382
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In systems using LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption, an attacker with physical access can corrupt the filesystem superblock. This forces GRUB into rescue mode while the decryption key remains in memory, allowing access to unencrypted data without authentication.
Risk Assessment
The organization faces data confidentiality loss on LUKS disks, as an attacker with physical access can read decrypted data without the password. Additionally, the ability to force this state through filesystem corruption poses a data integrity concern.
Recommendation
Update GRUB to a patched version and consider disabling TPM auto-decryption in high-risk physical access environments. Implement filesystem superblock integrity monitoring mechanisms.
Original NVD description (English source)
A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlying filesystem superblock, GRUB will fail to locate a valid filesystem and enter rescue mode. At this point, the disk is already decrypted, and the decryption key remains loaded in system memory. This scenario may allow an attacker with physical access to access the unencrypted data without any further authentication, thereby compromising data confidentiality. Furthermore, the ability to force this state through filesystem corruption also presents a data integrity concern.