Log in Start free

Vulnerability · Published Feb 19, 2025 · Assigned by redhat

CVE-2025-0624Grub2: net: out-of-bounds write in grub_net_search_config_file()

High 7.6

In plain English

A high-severity out-of-bounds write in grub2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)1.4%top 27.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to by-pass secure boot protections.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8grub2-common1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-common1:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-efi-aa641:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-efi-aa641:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-efi-aa64-cdboot1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-efi-aa64-cdboot1:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-efi-aa64-modules1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-efi-aa64-modules1:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-efi-ia321:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:8grub2-efi-ia32-cdboot1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:8grub2-efi-ia32-modules1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:8grub2-efi-x641:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-efi-x641:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-efi-x64-cdboot1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-efi-x64-cdboot1:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-efi-x64-modules1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-efi-x64-modules1:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-pc1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-pc1:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-pc-modules1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-pc-modules1:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-ppc64le1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-ppc64le1:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-ppc64le-modules1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-ppc64le-modules1:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-tools1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-tools1:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-tools-efi1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-tools-efi1:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-tools-extra1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-tools-extra1:2.06-94.el9_5.alma.1ALSA-2025:2867
AlmaLinux:8grub2-tools-minimal1:2.02-162.el8_10.alma.1ALSA-2025:3367
AlmaLinux:9grub2-tools-minimal1:2.06-94.el9_5.alma.1ALSA-2025:2867
Debian:12grub22.06-13+deb12u2DEBIAN-CVE-2025-0624
Debian:13grub22.12-6DEBIAN-CVE-2025-0624
Debian:14grub22.12-6DEBIAN-CVE-2025-0624
Rocky Linux:8grub21:2.02-162.el8_10.rocky.0.1RLSA-2025:3367
Rocky Linux:9grub21:2.06-94.el9_5RLSA-2025:2867
Ubuntu:22.04:LTSgrub2-signedno fix listedUBUNTU-CVE-2025-0624
Ubuntu:24.04:LTSgrub2-signedno fix listedUBUNTU-CVE-2025-0624
Ubuntu:25.10grub2-signedno fix listedUBUNTU-CVE-2025-0624
Ubuntu:26.04:LTSgrub2-signedno fix listedUBUNTU-CVE-2025-0624
Ubuntu:26.10grub2-signedno fix listedUBUNTU-CVE-2025-0624
Ubuntu:22.04:LTSgrub2-unsignedno fix listedUBUNTU-CVE-2025-0624
Ubuntu:24.04:LTSgrub2-unsignedno fix listedUBUNTU-CVE-2025-0624
Ubuntu:25.10grub2-unsignedno fix listedUBUNTU-CVE-2025-0624
Ubuntu:26.04:LTSgrub2-unsignedno fix listedUBUNTU-CVE-2025-0624
Ubuntu:26.10grub2-unsignedno fix listedUBUNTU-CVE-2025-0624

Affected products (as reported)

VendorProductVersions
grub2 0 – through 2.12
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support see references
Red Hat Red Hat OpenShift Container Platform 4.12 see references
Red Hat Red Hat OpenShift Container Platform 4.13 see references
Red Hat Red Hat OpenShift Container Platform 4.14 see references
Red Hat Red Hat OpenShift Container Platform 4.15 see references
Red Hat Red Hat OpenShift Container Platform 4.16 see references
Red Hat Red Hat OpenShift Container Platform 4.17 see references
Red Hat Red Hat OpenShift Container Platform 4.18 see references
Red Hat Red Hat Enterprise Linux 10 see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

References