CVE-2025-0622: Grub2: command/gpg: use-after-free due to hooks not being removed on module unload
A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw allows an attacker to force grub2 to call the hooks once the module that registered it was unloaded, leading to a use-after-free vulnerability. If correctly exploited, this vulnerability may result in arbitrary code execution, eventually allowing the attacker to bypass secure boot protections.
Other sources
In some scenarios hooks created by loaded modules are not being removed when the related module is being unloaded. An attacker may leverage this by forcing the grub2 to call the hooks once the module which registered it was unloaded, leading to a Use-after-free vulnerability. If correctly exploited this vulnerability may result in Arbitrary Code Execution eventually allowing the attacker to by-pass secure boot protections.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0622?
CVE-2025-0622 is classified as a use-after-free vulnerability, which can potentially allow attackers to execute arbitrary code.
How do I fix CVE-2025-0622?
To mitigate CVE-2025-0622, it is recommended to update to the latest version of GNU GRUB2 that addresses this vulnerability.
Which versions of GRUB2 are affected by CVE-2025-0622?
CVE-2025-0622 affects various versions of GNU GRUB2, specifically those that utilize modules with improperly managed hooks.
Can CVE-2025-0622 lead to remote code execution?
Yes, CVE-2025-0622 has the potential to lead to remote code execution if exploited by a malicious actor.
How can I check if my system is vulnerable to CVE-2025-0622?
You can check for vulnerability to CVE-2025-0622 by evaluating your installed version of GNU GRUB2 against security advisories.