CVE-2024-2312: Use After Free
GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2312?
CVE-2024-2312 is considered a high severity vulnerability due to its potential for secure boot bypass.
How do I fix CVE-2024-2312?
To fix CVE-2024-2312, update the GRUB2 package to the latest version provided by your Debian or Ubuntu distribution.
What systems are affected by CVE-2024-2312?
CVE-2024-2312 affects GRUB2 installed on Debian and Ubuntu operating systems.
What is the impact of CVE-2024-2312 on secure boot?
The impact of CVE-2024-2312 could lead to the possibility of bypassing secure boot protections.
Is CVE-2024-2312 a use-after-free issue?
Yes, CVE-2024-2312 is a use-after-free vulnerability that arises due to GRUB2 not releasing UEFI system table hooks correctly.