GNU grub2 grub_net_search_config_file out-of-bounds write

Summaryinfo

A vulnerability, which was classified as critical, has been found in GNU grub2. The impacted element is the function grub_net_search_config_file. The manipulation leads to out-of-bounds write. This vulnerability is documented as CVE-2025-0624. The attack requires being on the local network. There is not any exploit available.

Detailsinfo

A vulnerability was found in GNU grub2 (affected version unknown). It has been rated as critical. This issue affects the function grub_net_search_config_file. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to by-pass secure boot protections.

It is possible to read the advisory at bugzilla.redhat.com. The identification of this vulnerability is CVE-2025-0624 since 01/21/2025. The exploitation is known to be difficult. The attack can only be done within the local network. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/19/2025).

The vulnerability scanner Nessus provides a plugin with the ID 216508 (SUSE SLES15 Security Update : grub2 (SUSE-SU-2025:0588-1)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (216508), EUVD (EUVD-2025-4653) and CERT Bund (WID-SEC-2025-0396). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• NetApp ActiveIQ Unified Manager
• Dell NetWorker
• Dell Avamar
• Open Source Grub
• Red Hat OpenShift
• IBM QRadar SIEM

Productinfo

Vendor

• GNU

Name

• grub2

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion