CVE-2020-25632: Use After Free
A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
The rmmod implementation for grub2 is flawed, allowing an attacker to unload a module used as dependency without checking if any other dependent module is still loaded. This leads to an use-after-free scenario possibly allowing an attacker to execute arbitrary code and by-pass Secure Boot protections.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-25632?
CVE-2020-25632 is considered a high severity vulnerability that could allow arbitrary code execution.
How do I fix CVE-2020-25632?
The recommended fix for CVE-2020-25632 is to upgrade grub2 to version 2.06 or later.
Which versions of grub2 are affected by CVE-2020-25632?
Versions of grub2 prior to 2.06 are affected by CVE-2020-25632.
What impact does CVE-2020-25632 have on system security?
CVE-2020-25632 can lead to a use-after-free condition, potentially allowing a bypass of security mechanisms.
Is CVE-2020-25632 specific to certain Linux distributions?
Yes, CVE-2020-25632 affects multiple Linux distributions, including Red Hat Enterprise Linux and Fedora, prior to the recommended versions.