Debian Grub2 vulnerabilities

CVE-2022-3775 [HIGH] CVE-2022-3775: grub2 - When rendering certain unicode sequences, grub2's font code doesn't proper valid... When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not

CVE-2025-0684 [MEDIUM] CVE-2025-0684: grub2 - A flaw was found in grub2. When performing a symlink lookup from a reiserfs file... A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculations to overflow, causing it

CVE-2021-3697 [HIGH] CVE-2021-3697: grub2 - A crafted JPEG image may lead the JPEG reader to underflow its data pointer, all... A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be performed the attacker needs to perform some triage over the heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data corruption and eventual code execution or secure boot c

CVE-2025-0622 [MEDIUM] CVE-2025-0622: grub2 - A flaw was found in command/gpg. In some scenarios, hooks created by loaded modu... A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw allows an attacker to force grub2 to call the hooks once the module that registered it was unloaded, leading to a use-after-free vulnerability. If correctly exploited, this vulnerability may result in arbitrary code executi

CVE-2020-15707 [MEDIUM] CVE-2020-15707: grub2 - Integer overflows were discovered in the functions grub_cmd_initrd and grub_init... Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit archite

CVE-2015-8370 [HIGH] CVE-2015-8370: grub2 - Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximat... Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or

CVE-2025-0677 [MEDIUM] CVE-2025-0677: grub2 - A flaw was found in grub2. When performing a symlink lookup, the grub's UFS modu... A flaw was found in grub2. When performing a symlink lookup, the grub's UFS module checks the inode's data size to allocate the internal buffer to read the file content, however, it fails to check if the symlink data size has overflown. When this occurs, grub_malloc() may be called with a smaller value than needed. When further reading the data from the disk into the

CVE-2025-0685 [MEDIUM] CVE-2025-0685: grub2 - A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs f... A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a gru

CVE-2025-0686 [MEDIUM] CVE-2025-0686: grub2 - A flaw was found in grub2. When performing a symlink lookup from a romfs filesys... A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing

CVE-2020-27749 [MEDIUM] CVE-2020-27749: grub2 - A flaw was found in grub2 in versions prior to 2.06. Variable names present are ... A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible

CVE-2025-4382 [MEDIUM] CVE-2025-4382: grub2 - A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured ... A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlying filesystem superblock, GRUB will fail to locate a valid filesystem and

CVE-2021-20225 [MEDIUM] CVE-2021-20225: grub2 - A flaw was found in grub2 in versions prior to 2.06. The option parser allows an... A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Scope: local bookworm: resolv

CVE-2024-45780 [MEDIUM] CVE-2024-45780: grub2 - A flaw was found in grub2. When reading tar files, grub2 allocates an internal b... A flaw was found in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. However, it fails to properly verify the allocation against possible integer overflows. It's possible to cause the allocation length to overflow with a crafted tar file, leading to a heap out-of-bounds write. This flaw eventually allows an attacker to circumvent

CVE-2024-45776 [MEDIUM] CVE-2024-45776: grub2 - When reading the language .mo file in grub_mofile_open(), grub2 fails to verify ... When reading the language .mo file in grub_mofile_open(), grub2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead the buffer size calculation to overflow, leading to out-of-bound reads and writes. This flaw allows an attacker to leak sensitive data or overwrite critical data, possibly circumventing secure boot prote

CVE-2024-45781 [MEDIUM] CVE-2024-45781: grub2 - A flaw was found in grub2. When reading a symbolic link's name from a UFS filesy... A flaw was found in grub2. When reading a symbolic link's name from a UFS filesystem, grub2 fails to validate the string length taken as an input. The lack of validation may lead to a heap out-of-bounds write, causing data integrity issues and eventually allowing an attacker to circumvent secure boot protections. Scope: local bookworm: open bullseye: open forky: res

CVE-2024-45777 [MEDIUM] CVE-2024-45777: grub2 - A flaw was found in grub2. The calculation of the translation buffer when readin... A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in grub_gettext_getstr_from_position() may overflow, leading to a Out-of-bound write. This issue can be leveraged by an attacker to overwrite grub2's sensitive heap data, eventually leading to the circumvention of secure boot protections. Scope: local bookworm: open

CVE-2020-15706 [MEDIUM] CVE-2020-15706: grub2 - GRUB2 contains a race condition in grub_script_function_create() leading to a us... GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions. Scope: local bookworm: resolved (fix

CVE-2009-4128 [HIGH] CVE-2009-4128: grub - GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the submitted portion o... GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the submitted portion of a password with the actual password, which makes it easier for physically proximate attackers to conduct brute force attacks and bypass authentication by submitting a password whose length is 1. Scope: local bookworm: resolved bullseye: resolved trixie: resolved

CVE-2024-2312 [MEDIUM] CVE-2024-2312: grub2 - GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu'... GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 2.12-2) sid: resolved (fixed in 2.12-2) trixie: resolved (

CVE-2024-45774 [MEDIUM] CVE-2024-45774: grub2 - A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG pars... A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bounds of its internal buffers, resulting in an out-of-bounds write. The possibility of overwriting sensitive information to bypass secure boot protections is not discarded. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.12-6)