GRUB2 vulnerabilities

The vulnerability in grub2 involves improper validation of the width and height of glyphs when rendering certain unicode sequences. This can lead to an out-of-bounds write in grub2's heap, resulting in memory corruption and availability issues.

Multiple integer underflows in Grub2 versions 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the grub_username_get and grub_password_get functions.

A Use After Free vulnerability has been identified in the GRUB2 bootloader's normal module. The flaw occurs because the normal_exit command is not properly unregistered when its module is unloaded. An attacker can invoke the command after module removal, causing access to freed memory.

A Use-after-Free vulnerability has been found in the GRUB2 bootloader's 'normal' command. The flaw occurs because the command is not properly unregistered when the module is unloaded, allowing an attacker to access invalid memory locations. Successful exploitation leads to system instability and a complete crash.

A Use-after-Free vulnerability has been found in the GRUB2 bootloader's network module. The flaw is caused by improper unregistration of the net_set_vlan command when the module is unloaded from memory. An attacker can exploit this to cause system instability and a complete crash.

A flaw in the romfs module of GRUB2 allows integer overflow during buffer size calculation based on user-controlled filesystem geometry parameters. A crafted filesystem can cause a smaller-than-expected buffer allocation, leading to out-of-bounds writes in grub_romfs_read_symlink() and potentially arbitrary code execution.

A buffer overflow vulnerability was found in the jfs filesystem module of GRUB2. The grub_jfs_lookup_symlink() function writes beyond the allocated buffer when a specially crafted jfs filesystem is used. This can corrupt critical internal GRUB data and potentially lead to arbitrary code execution.

A flaw in GRUB2's reiserfs module allows integer overflow during symlink buffer size calculation, leading to heap out-of-bounds write and potential arbitrary code execution.

A flaw in GRUB2's squash4 module improperly checks integer overflows when determining internal buffer sizes from filesystem geometry. A crafted filesystem can cause a smaller buffer allocation, leading to a heap-based out-of-bounds write during data reading. This could allow arbitrary code execution and bypass Secure Boot protections.

A stack overflow vulnerability was found in the BFS file system support in GRUB2. A crafted BFS filesystem image can trigger an uncontrolled loop, causing GRUB2 to crash.

A flaw was found in grub2 when reading tar files. The function allocating a buffer for the file name does not properly check for integer overflows, which can lead to a heap out-of-bounds write. This allows an attacker to bypass secure boot protections.

An integer overflow vulnerability was found in the BFS file system driver in GRUB2. When reading a file with an indirect extent map, GRUB2 fails to validate the number of extent entries, leading to a heap out-of-bounds read.

A vulnerability in GRUB2 involves an integer overflow in a 32-bit variable tracking input length during keyboard read operations, leading to a heap-based buffer overflow. This can corrupt critical internal data within GRUB.

A flaw was found in grub2's UFS module when handling symbolic links. The function checking symlink data size does not verify overflow, leading to undersized buffer allocation and heap out-of-bounds write. An attacker can craft a malicious filesystem to corrupt heap memory and achieve arbitrary code execution, bypassing Secure Boot.

In Grub2, during the network boot process, when searching for the configuration file, data from a user-controlled environment variable is copied into an internal buffer using grub_strcpy() without considering the variable's length during buffer allocation, resulting in an out-of-bounds write. This could allow remote code execution from the same network segment where Grub is searching for boot information, bypassing Secure Boot protections.

A flaw in Grub2 allows the dump command to read arbitrary memory even when Grub is in lockdown mode, enabling an attacker to extract sensitive information such as signatures and salts from memory.

A flaw in grub2's calculation of the translation buffer when reading a .mo file in grub_gettext_getstr_from_position() may overflow, leading to an out-of-bounds write. An attacker can exploit this to overwrite sensitive heap data, ultimately bypassing Secure Boot protections.

A flaw in the GRUB2 command/gpg component causes hooks created by loaded modules not to be removed when the module is unloaded. This allows an attacker to trigger a use-after-free vulnerability by calling a hook after its module has been freed. Successful exploitation could lead to arbitrary code execution and bypass of Secure Boot protections.

A flaw was found in the GRUB2 bootloader in the HFS+ filesystem driver. When failing to mount an HFS+ partition, the driver does not properly set an ERRNO value, which may lead to a NULL pointer access.

A flaw was found in grub2 where it fails to validate the string length when reading a symbolic link's name from a UFS filesystem. This lack of validation may lead to a heap out-of-bounds write, compromising data integrity and potentially allowing an attacker to bypass Secure Boot protections.

In the grub_mofile_open() function when reading a language .mo file, GRUB2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead to buffer size calculation overflow, resulting in out-of-bound reads and writes.

A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the argument list, but fails to check if the allocation succeeded. If allocation fails, the parse_option() function processes a NULL pointer, causing grub to crash or, in rare scenarios, corrupt IVT data.

A flaw in grub2 allows an attacker to cause an out-of-bounds write by providing a specially crafted JPEG file to the JPEG parser. This can lead to memory corruption.

An out-of-bounds read flaw was found in the GRUB2 NTFS filesystem driver. A physically present attacker can present a specially crafted NTFS image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, posing a high confidentiality risk.

An out-of-bounds write flaw was found in the NTFS filesystem driver of GRUB2. This allows an attacker to provide a specially crafted NTFS filesystem image, corrupting GRUB's heap metadata and potentially UEFI firmware heap metadata.