A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer, impacting grub's sensitive data integrity and eventually leading to a secure boot protection bypass.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | amazon-linux-2023-upgrade-grub2-commonamazon-linux-2023-upgrade-grub2-debuginfoamazon-linux-2023-upgrade-grub2-debugsourceamazon-linux-2023-upgrade-grub2-efi-aa64amazon-linux-2023-upgrade-grub2-efi-aa64-cdbootamazon-linux-2023-upgrade-grub2-efi-aa64-ec2amazon-linux-2023-upgrade-grub2-efi-aa64-modulesamazon-linux-2023-upgrade-grub2-efi-x64amazon-linux-2023-upgrade-grub2-efi-x64-cdbootamazon-linux-2023-upgrade-grub2-efi-x64-ec2amazon-linux-2023-upgrade-grub2-efi-x64-modulesamazon-linux-2023-upgrade-grub2-emuamazon-linux-2023-upgrade-grub2-emu-debuginfoamazon-linux-2023-upgrade-grub2-emu-modulesamazon-linux-2023-upgrade-grub2-pcamazon-linux-2023-upgrade-grub2-pc-modulesamazon-linux-2023-upgrade-grub2-toolsamazon-linux-2023-upgrade-grub2-tools-debuginfoamazon-linux-2023-upgrade-grub2-tools-efiamazon-linux-2023-upgrade-grub2-tools-efi-debuginfoamazon-linux-2023-upgrade-grub2-tools-extraamazon-linux-2023-upgrade-grub2-tools-extra-debuginfoamazon-linux-2023-upgrade-grub2-tools-minimalamazon-linux-2023-upgrade-grub2-tools-minimal-debuginfo | Apr 15, 2025 | Feb 18, 2025 | |
| Debian | debian-upgrade-grub2no-fix-debian-deb-package | May 15, 2025 | Mar 3, 2025 | |
| Dell Powerstore Dsa2025342 | dell-powerstoreos-upgrade-latest | Oct 23, 2025 | Sep 2, 2025 | |
| Dell Powerstore Dsa2026039 | dell-powerstoreos-upgrade-latest | Jan 13, 2026 | Jan 6, 2026 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-grub2-commonhuawei-euleros-2_0_sp10-upgrade-grub2-efi-aa64huawei-euleros-2_0_sp10-upgrade-grub2-efi-aa64-moduleshuawei-euleros-2_0_sp10-upgrade-grub2-toolshuawei-euleros-2_0_sp10-upgrade-grub2-tools-extrahuawei-euleros-2_0_sp10-upgrade-grub2-tools-minimal | May 13, 2025 | Mar 3, 2025 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-grub2-commonhuawei-euleros-2_0_sp11-upgrade-grub2-efi-aa64huawei-euleros-2_0_sp11-upgrade-grub2-efi-aa64-moduleshuawei-euleros-2_0_sp11-upgrade-grub2-toolshuawei-euleros-2_0_sp11-upgrade-grub2-tools-extrahuawei-euleros-2_0_sp11-upgrade-grub2-tools-minimal | Jun 13, 2025 | Mar 3, 2025 | |
| Huawei Euleros 2_0_sp12 | huawei-euleros-2_0_sp12-upgrade-grub2-commonhuawei-euleros-2_0_sp12-upgrade-grub2-efi-aa64huawei-euleros-2_0_sp12-upgrade-grub2-efi-aa64-moduleshuawei-euleros-2_0_sp12-upgrade-grub2-toolshuawei-euleros-2_0_sp12-upgrade-grub2-tools-extrahuawei-euleros-2_0_sp12-upgrade-grub2-tools-minimal | Jun 11, 2025 | Mar 3, 2025 | |
| Huawei Euleros 2_0_sp13 | huawei-euleros-2_0_sp13-upgrade-grub2-commonhuawei-euleros-2_0_sp13-upgrade-grub2-efi-x64huawei-euleros-2_0_sp13-upgrade-grub2-efi-x64-moduleshuawei-euleros-2_0_sp13-upgrade-grub2-pchuawei-euleros-2_0_sp13-upgrade-grub2-pc-moduleshuawei-euleros-2_0_sp13-upgrade-grub2-toolshuawei-euleros-2_0_sp13-upgrade-grub2-tools-efihuawei-euleros-2_0_sp13-upgrade-grub2-tools-extrahuawei-euleros-2_0_sp13-upgrade-grub2-tools-minimal | Jun 11, 2025 | Mar 3, 2025 | |
| Suse | — | suse-upgrade-grub2suse-upgrade-grub2-arm64-efisuse-upgrade-grub2-arm64-efi-debugsuse-upgrade-grub2-arm64-efi-extrassuse-upgrade-grub2-branding-upstreamsuse-upgrade-grub2-commonsuse-upgrade-grub2-i386-pcsuse-upgrade-grub2-i386-pc-debugsuse-upgrade-grub2-i386-pc-extrassuse-upgrade-grub2-i386-xen-debugsuse-upgrade-grub2-powerpc-ieee1275suse-upgrade-grub2-powerpc-ieee1275-debugsuse-upgrade-grub2-powerpc-ieee1275-extrassuse-upgrade-grub2-s390x-emususe-upgrade-grub2-s390x-emu-debugsuse-upgrade-grub2-s390x-emu-extrassuse-upgrade-grub2-snapper-pluginsuse-upgrade-grub2-systemd-sleep-pluginsuse-upgrade-grub2-x86_64-efisuse-upgrade-grub2-x86_64-efi-debugsuse-upgrade-grub2-x86_64-efi-extrassuse-upgrade-grub2-x86_64-xensuse-upgrade-grub2-x86_64-xen-debugsuse-upgrade-grub2-x86_64-xen-extras | Dec 5, 2025 | Apr 10, 2025 |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub