CVE-2025-0689: Grub2: udf: heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution
First published: Mon Feb 17 2025(Updated: )
When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buffers. In certain scenarios, while iterating through disk sectors, it assumes the read size from the disk is always smaller than the allocated buffer size which is not guaranteed. A crafted filesystem image may lead to a heap-based buffer overflow resulting in critical data to be corrupted, resulting in the risk of arbitrary code execution by-passing secure boot protections.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ubuntu GRUB (GNU GRand Unified Bootloader) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-0689?
CVE-2025-0689 is classified as a high-severity vulnerability due to potential exploitation that could lead to system compromise.
How do I fix CVE-2025-0689?
To mitigate CVE-2025-0689, update your GNU GRUB to the latest version that addresses this vulnerability.
Which versions of GRUB are affected by CVE-2025-0689?
CVE-2025-0689 affects specific configurations of GNU GRUB, particularly those that utilize the UDF filesystem module.
What type of vulnerability is CVE-2025-0689?
CVE-2025-0689 is a type of buffer overflow vulnerability that occurs during disk read operations.
Can CVE-2025-0689 be exploited remotely?
Yes, under certain conditions, CVE-2025-0689 may be exploited remotely if the vulnerable GRUB configuration is accessed over a network.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-0689
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/source
- agent/author
- agent/tags
- agent/trending
- agent/event
- vendor/gnu
- canonical/ubuntu grub (gnu grand unified bootloader)