PT-2025-7459 · Grub2+9 · Grub2+9
CVE-2025-0624
·
Publicado
2025-02-18
·
Atualizado
2026-06-29
CVSS v3.1
7.6
Alta
| Vetor | AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
grub2 (affected versions not specified)
Description
A flaw was found in grub2 during the network boot process. When trying to search for the configuration file, grub copies data from a user-controlled environment variable into an internal buffer using the
grub strcpy() function. It fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to bypass secure boot protections.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
RCE
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Red Hat
Red Os
Rocky Linux
Suse
Grub2