Various SecureBoot bypasses, data integrity violations and sensitive data leaks in Grub

CVE / CVSS

Die Basiswerte stammen von der NVD oder, falls die NVD noch keinen hat, aus dem CVE-Eintrag. Proxmox selbst veröffentlicht keine CVSS-Werte. „Aktiv ausgenutzt“ stammt aus dem CISA-KEV-Katalog, EPSS (Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen) von FIRST.

Details

21 issues in Grub's codebase were found that could allow an attacker to bypass Secure Boot protections (if enabled), leak sensitive data from Grub's environment or configuration or violate other integrity protections within Grub.

Behoben in

• grub-pc-bin (>= 2.06-13+pmx5)

• grub-efi-amd64-bin (>= 2.06-13+pmx5)

• grub-efi-amd64-unsigned (>= 2.06-13+pmx5)

• grub-efi-amd64-signed (>= 1+2.06+13+pmx5)

• proxmox-secure-boot-policies (>= 0.0~git20240117.c443a5f-5)

• proxmox-secure-boot-policies-amd64-signed (>= 0.0~git20240117.c443a5f-5)

To fully prevent downgrade attacks after upgrading to fixed versions of the packages, see the instructions in our wiki:

https://pve.proxmox.com/wiki/Secure_Boot_Setup#Setting_a_Stricter_Revocation_Policy (öffnet in neuem Tab)

Referenzen

CVE-2024-45774 (öffnet in neuem Tab): reader/jpeg: Heap OOB Write during JPEG parsing.

CVE-2024-45775 (öffnet in neuem Tab): commands/extcmd: Missing check for failed allocation.

CVE-2024-45776 (öffnet in neuem Tab): grub-core/gettext: Integer overflow leads to Heap OO Write and Read.

CVE-2024-45777 (öffnet in neuem Tab): grub-core/gettext: Integer overflow leads to Heap OOB Write.

CVE-2024-45778 (öffnet in neuem Tab): fs/bfs: Integer overflow in the BFS parser.

CVE-2024-45779 (öffnet in neuem Tab): fs/bfs: Integer overflow leads to Heap OOB Read (Write?) in the BFS parser.

CVE-2024-45780 (öffnet in neuem Tab): fs/tar: Integer Overflow causes Heap OOB Write.

CVE-2024-45781 (öffnet in neuem Tab): fs/ufs: OOB write in the heap.

CVE-2024-45782 (öffnet in neuem Tab): fs/hfs: strcpy() using the volume name (fs/hfs.c:382)

CVE-2024-45783 (öffnet in neuem Tab): fs/hfs+: refcount can be decremented twice

CVE-2025-0622 (öffnet in neuem Tab): command/gpg: Use-after-free due to hooks not being removed on module unload

CVE-2025-0624 (öffnet in neuem Tab): net: Out-of-bounds write in grub_net_search_config_file()

CVE-2025-0677 (öffnet in neuem Tab): UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks

CVE-2025-0678 (öffnet in neuem Tab): squash4: Integer overflow may lead to heap based out-of-bounds write when reading data

CVE-2025-0684 (öffnet in neuem Tab): reiserfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data

CVE-2025-0685 (öffnet in neuem Tab): jfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data

CVE-2025-0686 (öffnet in neuem Tab): romfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data

CVE-2025-0689 (öffnet in neuem Tab): udf: Heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution

CVE-2025-0690 (öffnet in neuem Tab): read: Integer overflow may lead to out-of-bounds write

CVE-2025-1118 (öffnet in neuem Tab): commands/dump: The dump command is not in lockdown when secure boot is enabled

CVE-2025-1125 (öffnet in neuem Tab): fs/hfs: Integer overflow may lead to heap based out-of-bounds write