Riskcovery

CVE-2025-0624

Grub2: net: out-of-bounds write in grub_net_search_config_file()

State
Published
Severity
7.6 High
Published
Feb 19, 2025
Updated
Oct 13, 2026
Reserved
Jan 21, 2025

Read the record on cve.org

Description

A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to by-pass secure boot protections.

Scores

CVSSScoreVectorSource
3.17.6 HighCVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Hredhat

Weaknesses

Affected Products

ProductVersions
grub2
  • 2.12 and earlierAffected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat
  • 1:2.02-0.87.el7_9.15 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 1:2.02-162.el8_10 and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat
  • 1:2.02-87.el8_2.13 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat
  • 1:2.02-99.el8_4.12 and laterNot affected
Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceRed Hat
  • 1:2.02-99.el8_4.12 and laterNot affected
Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsRed Hat
  • 1:2.02-99.el8_4.12 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat
  • 1:2.02-123.el8_6.18 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat
  • 1:2.02-123.el8_6.18 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat
  • 1:2.02-123.el8_6.18 and laterNot affected
Red Hat Enterprise Linux 8.8 Extended Update SupportRed Hat
  • 1:2.02-152.el8_8.2 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 1:2.06-94.el9_5 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat
  • 1:2.06-27.el9_0.22 and laterNot affected
Red Hat Enterprise Linux 9.2 Extended Update SupportRed Hat
  • 1:2.06-61.el9_2.10 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat
  • 1:2.06-86.el9_4.2 and laterNot affected
Red Hat OpenShift Container Platform 4.12Red Hat
  • 412.86.202503310142-0 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat
  • 413.92.202504070146-0 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat
  • 414.92.202505141057-0 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat
  • 415.92.202504282058-0 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat
  • 416.94.202503252048-0 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat
  • 417.94.202503241418-0 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat
  • 418.94.202504021150-0 and laterNot affected
Red Hat Enterprise Linux 10Red Hat

    References

    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.