Debian Grub2 vulnerabilities

CVE-2020-10713 [HIGH] CVE-2020-10713: grub2 - A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2... A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alt

CVE-2023-4692 [HIGH] CVE-2023-4692: grub2 - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This is... An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achie

CVE-2024-56737 [HIGH] CVE-2024-56737: grub2 - GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c v... GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.12-6) sid: resolved (fixed in 2.12-6) trixie: resolved (fixed in 2.12-6)

CVE-2025-0678 [HIGH] CVE-2025-0678: grub2 - A flaw was found in grub2. When reading data from a squash4 filesystem, grub's s... A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub

CVE-2025-61662 [HIGH] CVE-2025-61662: grub2 - A Use-After-Free vulnerability has been discovered in GRUB's gettext module. Thi... A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could

CVE-2022-2601 [HIGH] CVE-2022-2601: grub2 - A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted ... A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism. Sco

CVE-2020-25632 [HIGH] CVE-2020-25632: grub2 - A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation al... A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to d

CVE-2022-28733 [HIGH] CVE-2022-28733: grub2 - Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet ca... Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a small integer number which will be used in memory allocation. If the attack succeeds in such way, subsequent opera

CVE-2020-14372 [HIGH] CVE-2020-14372: grub2 - A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enable... A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded an

CVE-2025-0624 [HIGH] CVE-2025-0624: grub2 - A flaw was found in grub2. During the network boot process, when trying to searc... A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write

CVE-2022-28736 [MEDIUM] CVE-2022-28736: grub2 - There's a use-after-free vulnerability in grub_cmd_chainloader() function; The c... There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensit

CVE-2025-1125 [HIGH] CVE-2025-1125: grub2 - When reading data from a hfs filesystem, grub's hfs filesystem module uses user-... When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal buffers size, however it misses to properly check for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculation to overflow, causing it to perform a grub_malloc() operation wi

CVE-2024-45782 [HIGH] CVE-2024-45782: grub2 - A flaw was found in the HFS filesystem. When reading an HFS volume's name at gru... A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer, impacting grub's sensitive data integrity and eventually leading to a sec

CVE-2025-0689 [HIGH] CVE-2025-0689: grub2 - When reading data from disk, the grub's UDF filesystem module utilizes the user ... When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buffers. In certain scenarios, while iterating through disk sectors, it assumes the read size from the disk is always smaller than the allocated buffer size which is not guaranteed. A crafted filesystem image may lead to a heap-based b

CVE-2020-25647 [HIGH] CVE-2020-25647: grub2 - A flaw was found in grub2 in versions prior to 2.06. During USB device initializ... A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from t

CVE-2022-28735 [MEDIUM] CVE-2022-28735: grub2 - The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powe... The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules to be loaded in GRUB2 breaking the secure boot trust-chain. Scope: local bookworm: resolved (fixed in 2.06-3) bullseye: resolved (fixed in 2.06-3~deb11u1) forky: resolved (fixed in 2.06-3) s

CVE-2021-20233 [HIGH] CVE-2021-20233: grub2 - A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the me... A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulner

CVE-2022-28734 [HIGH] CVE-2022-28734: grub2 - Out-of-bounds write when handling split HTTP headers; When handling split HTTP h... Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NULL byte past the buffer. It's conceivable that an attacker controlled set of packets can lead to corruption of

CVE-2020-27779 [HIGH] CVE-2020-27779: grub2 - A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not... A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest threat from this vulnerability is to data confidentiality and integrity a

CVE-2017-9763 [HIGH] CVE-2017-9763: grub2 - The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12, as... The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote attackers to cause a denial of service (excessive stack use and application crash) via a crafted binary file, related to use of a variable-size stack array. Scope: local bookworm: resolved (fixed in 2.02~beta2-8) bullseye: resolved