GNU grub2 Network net_set_vlan expired pointer dereference

Summaryinfo

A vulnerability was found in GNU grub2. It has been classified as problematic. The affected element is the function net_set_vlan of the component Network Module. The manipulation leads to expired pointer dereference. This vulnerability is referenced as CVE-2025-54770. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability was found in GNU grub2 (unknown version). It has been rated as problematic. This issue affects the function net_set_vlan of the component Network Module. The manipulation with an unknown input leads to a expired pointer dereference vulnerability. Using CWE to declare the problem leads to CWE-825. The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability

It is possible to read the advisory at access.redhat.com. The identification of this vulnerability is CVE-2025-54770 since 07/28/2025. The exploitation is known to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 275747 (Linux Distros Unpatched Vulnerability : CVE-2025-54770), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (275747), EUVD (EUVD-2025-198077) and CERT Bund (WID-SEC-2025-2638). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Open Source Grub
• Red Hat OpenShift

Productinfo

Vendor

• GNU

Name

• grub2

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion