CVE-2025-61664: Grub2: missing unregister call for normal_exit command may lead to use-after-free
A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normalexit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.
Other sources
Grub2: missing unregister call for normalexit command may lead to use-after-free
— Microsoft
The normalexit command is registered in the normal module during load. However, the command is not unregistered at the module unload. So, this may lead to use-after-free issue when the normalexit command is invoked after the normal module unload.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61664?
CVE-2025-61664 is classified as a high-severity vulnerability due to its exploitation potential in the GRUB2 bootloader.
How can I mitigate CVE-2025-61664?
To mitigate CVE-2025-61664, users should update to a patched version of GRUB2 that fixes the memory Use After Free issue.
What systems are affected by CVE-2025-61664?
CVE-2025-61664 affects systems running the GNU GRUB2 bootloader, specifically those using the normal module.
What is the impact of exploiting CVE-2025-61664?
Exploiting CVE-2025-61664 could allow an attacker to execute arbitrary code during the boot process, leading to a potential system compromise.
Who should be concerned about CVE-2025-61664?
System administrators and users of the GNU GRUB2 bootloader should be particularly concerned about CVE-2025-61664 and take appropriate action to secure their systems.