GRUB2 Vulnerabilities Put Millions of Linux Devices at Risk

GRUB2 vulnerabilities expose millions of Linux devices to secure boot bypass and remote code execution. Discovered during a security audit, these flaws impact filesystem parsing, memory management, and network settings. Patches released on February 18, 2025, address issues like heap overflows and memory corruption in UEFI environments.

GRUB2 Vulnerability

GRUB2’s critical role in booting operating systems makes it a prime target for attackers. Researchers found multiple flaws in filesystem drivers, including integer overflows in UFS, HFS+, and ReiserFS.

CVE-2025-0677: Crafted symlinks in UFS partitions can cause buffer overflows.
CVE-2024-45782: Unvalidated HFS volume names can overwrite heap metadata.
CVE-2025-0624: Malicious DHCP servers can exploit GRUB2’s network stack, leading to remote code execution before the OS loads.

“These flaws allow attackers to compromise systems before security protections activate,” said Red Hat engineer Marco A Benatto.

Seven vulnerabilities arise from insufficient bounds checking in filesystem drivers:

CVE-2025-0678 (Squash4) & CVE-2025-0685 (JFS): Malicious size values trigger out-of-bounds writes during file reads.
CVE-2025-0686 (ROMFS): Integer overflow in symlink resolution corrupts heap structures.
CVE-2024-45774: Crafted JPEGs in boot themes or EFI partitions can overwrite memory via duplicate SOF0 markers, enabling persistence.
CVE-2025-0622: Use-after-free in the GPG module allows execution of rogue payloads, threatening UEFI Secure Boot.
CVE-2025-1118: Unsecured memory dumps risk exposing cryptographic secrets under Secure Boot.

“These flaws bypass integrity checks by exploiting legitimate filesystem operations,” said Oracle’s Jan Setje-Eilers.

To address GRUB2 security flaws, updates must be applied to GRUB2, shim, and SBAT metadata, as traditional UEFI revocation lists (dbx) won’t be used.

Update Requirements: Vendors must rebuild boot artifacts using SBAT generation 5 or higher to ensure component-level revocation.
Patch Deployment: Major Linux distributions like Red Hat, SUSE, and Oracle Linux began releasing updates on February 25, 2025.
Residual Risks: Legacy systems and embedded devices remain vulnerable due to infrequent update cycles.
Security Implications: Unpatched systems could compromise network-wide Secure Boot integrity.

Key Takeaways for Administrators

Prioritize Bootloader Updates: Ensure GRUB2 and related components are patched.
Verify SBAT Status: Use tools like mokutil to check compliance.
Enhance Security Practices: Developers should adopt memory-safe coding to prevent future vulnerabilities.

As attackers target low-level components, cross-industry collaboration remains vital in securing firmware and maintaining system integrity.