REDHAT-BUG-2346121: Integer Overflow
First published: Mon Feb 17 2025(Updated: )
When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffers size, however it misses to properly check for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculation to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result the grub_romfs_read_symlink() may cause a out-of-bounds writes when calling grub_disk_read() function. This flaw may be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution by-passing secure boot protections.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GRUB for EFI (ARM64) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-2346121?
The severity of REDHAT-BUG-2346121 is categorized as high due to potential integer overflow vulnerabilities.
How do I fix REDHAT-BUG-2346121?
To fix REDHAT-BUG-2346121, update the GNU GRUB to the latest version that addresses this integer overflow issue.
Which versions of GNU GRUB are affected by REDHAT-BUG-2346121?
REDHAT-BUG-2346121 affects certain configurations of GNU GRUB that utilize the romfs filesystem module.
What are the risks associated with REDHAT-BUG-2346121?
The risks associated with REDHAT-BUG-2346121 include potential remote code execution when a malicious filesystem is accessed.
How can I mitigate the risks of REDHAT-BUG-2346121 until a fix is applied?
To mitigate the risks of REDHAT-BUG-2346121, avoid using potentially untrusted or malicious filesystems with GRUB.
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-0686
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/type
- agent/source
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gnu
- canonical/grub for efi (arm64)