CVE-2025-0686

A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the grub_romfs_read_symlink() may cause out-of-bounds writes when the calling grub_disk_read() function. This issue may be leveraged to corrupt grub's internal critical data and can result in arbitrary code execution by-passing secure boot protections.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-0686	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2346121	Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-03 18:15

Updated : 2025-07-28 17:23

NVD link : CVE-2025-0686

Mitre link : CVE-2025-0686

CVE.ORG link : CVE-2025-0686

JSON object : View

Products Affected

gnu

grub2

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2025-0686", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}]}, "published": "2025-03-03T18:15:30.930", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-0686", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2346121", "tags": ["Issue Tracking"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the grub_romfs_read_symlink() may cause out-of-bounds writes when the calling grub_disk_read() function. This issue may be leveraged to corrupt grub's internal critical data and can result in arbitrary code execution by-passing secure boot protections."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en grub2. Al realizar una b\u00fasqueda de enlace simb\u00f3lico desde un sistema de archivos romfs, el m\u00f3dulo de sistema de archivos romfs de grub utiliza par\u00e1metros controlados por el usuario de la geometr\u00eda del sistema de archivos para determinar el tama\u00f1o del b\u00fafer interno; sin embargo, verifica incorrectamente si hay desbordamientos de n\u00fameros enteros. Un sistema de archivos manipulado con fines malintencionados puede provocar que algunos de esos c\u00e1lculos de tama\u00f1o de b\u00fafer se desborden, lo que hace que realice una operaci\u00f3n grub_malloc() con un tama\u00f1o menor al esperado. Como resultado, grub_romfs_read_symlink() puede provocar escrituras fuera de los l\u00edmites cuando se llama a la funci\u00f3n grub_disk_read(). Este problema se puede aprovechar para corromper los datos cr\u00edticos internos de grub y puede provocar la ejecuci\u00f3n de c\u00f3digo arbitrario que pasa por alto las protecciones de arranque seguro."}], "lastModified": "2025-07-28T17:23:26.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6ECC2401-511C-4A2E-878F-C7053FA3ABB1", "versionEndIncluding": "2.12"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}