Executive brief
A vulnerability in the GRUB2 bootloader, a critical component used to start Linux-based operating systems, could allow an attacker to crash the system. By triggering a specific error in how the bootloader manages its internal commands, the system may attempt to access invalid memory, leading to an immediate shutdown or instability. This primarily impacts the availability of the server or device, potentially disrupting operations or requiring manual intervention to recover.
Technical details
A Use-after-Free (UAF) vulnerability exists in GRUB2 due to an expired pointer dereference (CWE-825). The 'normal' command is registered when the corresponding module is loaded but is not correctly unregistered during module unloading. An attacker with the ability to execute commands within the GRUB2 environment can trigger this flaw by invoking the command after the module has been unloaded. This causes the bootloader to access memory locations that are no longer valid, resulting in system instability, a complete crash (Denial of Service), and potential minor impacts on data integrity or confidentiality. The vulnerability is tracked by Red Hat as having a medium severity with a local attack vector and high complexity.
Affected products
- GNU grub2 <= 2.14
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat OpenShift Container Platform 4
- Red Hat Red Hat In-Vehicle Operating System 1
Timeline
- 2025-11-12: other: Bug reported to Red Hat Bugzilla
- 2025-11-18: disclosed: CVE published