CVE-2025-0624
First published: Mon Feb 17 2025(Updated: )
A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to by-pass secure boot protections.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GRUB |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-0624?
CVE-2025-0624 has been classified as a high severity vulnerability due to the potential for exploitation during the network boot process.
How do I fix CVE-2025-0624?
To fix CVE-2025-0624, update your GNU GRUB 2 to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2025-0624?
CVE-2025-0624 is a buffer overflow vulnerability caused by inadequate length checking on environment variables during the network boot process.
Who is affected by CVE-2025-0624?
CVE-2025-0624 affects all versions of GNU GRUB 2 that utilize the grub_strcpy() function during the boot configuration process.
What are the potential impacts of CVE-2025-0624?
The potential impacts of CVE-2025-0624 include arbitrary code execution, system compromise, or denial of service during network boot operations.
- collector/nvd-api
- source/NVD
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/type
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-0624
- agent/severity
- agent/source
- agent/description
- agent/first-publish-date
- agent/trending
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- vendor/gnu