Debian Grub2 vulnerabilities

CVE-2020-14309 [MEDIUM] CVE-2020-14309: grub2 - There's an issue with grub2 in all versions before 2.06 when handling squashfs f... There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data. Scope: local bookworm: resolved (fixed in 2.04-9) bu

CVE-2020-14308 [MEDIUM] CVE-2020-14308: grub2 - In grub2 versions before 2.06 the grub memory allocator doesn't check for possib... In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process. Scope: local bookworm: resolved (fixed in 2.04-9

CVE-2024-45779 [MEDIUM] CVE-2024-45779: grub2 - An integer overflow flaw was found in the BFS file system driver in grub2. When ... An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an indirect extent map, grub2 fails to validate the number of extent entries to be read. A crafted or corrupted BFS filesystem may cause an integer overflow during the file reading, leading to a heap of bounds read. As a consequence, sensitive data may be leaked, or g

CVE-2025-61664 [MEDIUM] CVE-2025-61664: grub2 - A vulnerability in the GRUB2 bootloader has been identified in the normal module... A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a

CVE-2025-61663 [MEDIUM] CVE-2025-61663: grub2 - A vulnerability has been identified in the GRUB2 bootloader's normal command tha... A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer

CVE-2021-3696 [MEDIUM] CVE-2021-3696: grub2 - A heap out-of-bounds write may heppen during the handling of Huffman tables in t... A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be considered Low as it's very complex to an attacker control the encoding and positioning of corrupted Huffman entries to achieve results such as arbitrary code executi

CVE-2025-0690 [MEDIUM] CVE-2025-0690: grub2 - The read command is used to read the keyboard input from the user, while reads i... The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to reallocate the line buffer to accept the next character. During this process, with a line big enough it's possible to make this variable to overflow leading to a out-of-bounds write in the heap based buffer. This f

CVE-2020-14310 [MEDIUM] CVE-2020-14310: grub2 - There is an issue on grub2 before version 2.06 at function read_section_as_strin... There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_

CVE-2025-54770 [MEDIUM] CVE-2025-54770: grub2 - A vulnerability has been identified in the GRUB2 bootloader's network module tha... A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. An attacker who can execute this command can force the system to access memory loc

CVE-2021-3695 [MEDIUM] CVE-2021-3695: grub2 - A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the he... A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform some triage over the heap layout to achieve signifca

CVE-2020-14311 [MEDIUM] CVE-2020-14311: grub2 - There is an issue with grub2 before version 2.06 while handling symlink on ext f... There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow. Scope: local bookworm: resolved (fixed in 2.04-9) bullseye: resolved (fixed in 2.04-9)

CVE-2025-54771 [MEDIUM] CVE-2025-54771: grub2 - A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unifie... A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or c

CVE-2023-4693 [MEDIUM] CVE-2023-4693: grub2 - An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This iss... An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk. Scope: local bookworm

CVE-2024-45775 [MEDIUM] CVE-2024-45775: grub2 - A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub... A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the grub's argument list. However, it fails to check in case the memory allocation fails. Once the allocation fails, a NULL point will be processed by the parse_option() function, leading grub to crash or, in some rare scenarios, corrupt the IVT d

CVE-2024-45778 [MEDIUM] CVE-2024-45778: grub2 - A stack overflow flaw was found when reading a BFS file system. A crafted BFS fi... A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.12-6) sid: resolved (fixed in 2.12-6) trixie: resolved (fixed in 2.12-6)

CVE-2025-61661 [MEDIUM] CVE-2025-61661: grub2 - A vulnerability has been identified in the GRUB (Grand Unified Bootloader) compo... A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this iss

CVE-2025-1118 [MEDIUM] CVE-2025-1118: grub2 - A flaw was found in grub2. Grub's dump command is not blocked when grub is in lo... A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.12-6) sid: resolved (fixed in

CVE-2024-45783 [MEDIUM] CVE-2024-45783: grub2 - A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus files... A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL pointer access. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.12-6) sid: resolved (fixed in 2.12-6) trixie: resolved (fixed in 2.12-6)

CVE-2021-3981 [LOW] CVE-2021-3981: grub2 - A flaw in grub2 was found where its configuration file, known as grub.cfg, is be... A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in grub.cfg. This flaw affects grub2 2.06 and previous versions. This issue has

CVE-2013-4577 [LOW] CVE-2013-4577: grub2 - A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg... A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the password_pbkdf2 directive in the file. Scope: local bookworm: resolved (fixed in 2.00-20) bullseye: resolved (fixed in 2.00-20) forky: resolved (fixed in 2.00-20) sid: resolved (fixed in 2.00-20) trixie: reso