CVE-2025-0689: Grub2: udf: heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution
Grub2: udf: heap based buffer overflow in grubudfreadblock() may lead to arbitrary code execution
Other sources
When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buffers. In certain scenarios, while iterating through disk sectors, it assumes the read size from the disk is always smaller than the allocated buffer size which is not guaranteed. A crafted filesystem image may lead to a heap-based buffer overflow resulting in critical data to be corrupted, resulting in the risk of arbitrary code execution by-passing secure boot protections.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.06-25 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.06-15
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0689?
CVE-2025-0689 is classified as a high-severity vulnerability due to potential exploitation that could lead to system compromise.
How do I fix CVE-2025-0689?
To mitigate CVE-2025-0689, update your GNU GRUB to the latest version that addresses this vulnerability.
Which versions of GRUB are affected by CVE-2025-0689?
CVE-2025-0689 affects specific configurations of GNU GRUB, particularly those that utilize the UDF filesystem module.
What type of vulnerability is CVE-2025-0689?
CVE-2025-0689 is a type of buffer overflow vulnerability that occurs during disk read operations.
Can CVE-2025-0689 be exploited remotely?
Yes, under certain conditions, CVE-2025-0689 may be exploited remotely if the vulnerable GRUB configuration is accessed over a network.