Log in Start free

Vulnerability · Published May 9, 2025 · Assigned by redhat

CVE-2025-4382Grub2: grub allow access to encrypted device through cli once root device is unlocked via tpm

Medium 5.9

In plain English

A medium-severity missing authentication in grub2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.4%top 70.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlying filesystem superblock, GRUB will fail to locate a valid filesystem and enter rescue mode. At this point, the disk is already decrypted, and the decryption key remains loaded in system memory. This scenario may allow an attacker with physical access to access the unencrypted data without any further authentication, thereby compromising data confidentiality. Furthermore, the ability to force this state through filesystem corruption also presents a data integrity concern.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12grub2no fix listedDEBIAN-CVE-2025-4382
Debian:13grub2no fix listedDEBIAN-CVE-2025-4382
Debian:14grub22.14~git20250718.0e36779-2DEBIAN-CVE-2025-4382
Ubuntu:22.04:LTSgrub2-signedno fix listedUBUNTU-CVE-2025-4382
Ubuntu:24.04:LTSgrub2-signedno fix listedUBUNTU-CVE-2025-4382
Ubuntu:25.10grub2-signedno fix listedUBUNTU-CVE-2025-4382
Ubuntu:26.04:LTSgrub2-signedno fix listedUBUNTU-CVE-2025-4382
Ubuntu:26.10grub2-signedno fix listedUBUNTU-CVE-2025-4382
Ubuntu:22.04:LTSgrub2-unsignedno fix listedUBUNTU-CVE-2025-4382
Ubuntu:24.04:LTSgrub2-unsignedno fix listedUBUNTU-CVE-2025-4382
Ubuntu:25.10grub2-unsignedno fix listedUBUNTU-CVE-2025-4382
Ubuntu:26.04:LTSgrub2-unsignedno fix listedUBUNTU-CVE-2025-4382
Ubuntu:26.10grub2-unsignedno fix listedUBUNTU-CVE-2025-4382

Affected products (as reported)

VendorProductVersions
grub2 0 – through 2.12
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references

Weakness: CWE-306 · Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References