Various SecureBoot bypasses, data integrity violations and sensitive data leaks in Grub

CVE / CVSS

Base scores are looked up from NVD or, if NVD has none yet, the CVE record. Proxmox itself does not publish CVSS scores. “Actively exploited” comes from the CISA KEV catalog, EPSS (probability of exploitation in the next 30 days) from FIRST.

Details

21 issues in Grub's codebase were found that could allow an attacker to bypass Secure Boot protections (if enabled), leak sensitive data from Grub's environment or configuration or violate other integrity protections within Grub.

Fixed in

• grub-pc-bin (>= 2.06-13+pmx5)

• grub-efi-amd64-bin (>= 2.06-13+pmx5)

• grub-efi-amd64-unsigned (>= 2.06-13+pmx5)

• grub-efi-amd64-signed (>= 1+2.06+13+pmx5)

• proxmox-secure-boot-policies (>= 0.0~git20240117.c443a5f-5)

• proxmox-secure-boot-policies-amd64-signed (>= 0.0~git20240117.c443a5f-5)

To fully prevent downgrade attacks after upgrading to fixed versions of the packages, see the instructions in our wiki:

https://pve.proxmox.com/wiki/Secure_Boot_Setup#Setting_a_Stricter_Revocation_Policy (opens in a new tab)

References

CVE-2024-45774 (opens in a new tab): reader/jpeg: Heap OOB Write during JPEG parsing.

CVE-2024-45775 (opens in a new tab): commands/extcmd: Missing check for failed allocation.

CVE-2024-45776 (opens in a new tab): grub-core/gettext: Integer overflow leads to Heap OO Write and Read.

CVE-2024-45777 (opens in a new tab): grub-core/gettext: Integer overflow leads to Heap OOB Write.

CVE-2024-45778 (opens in a new tab): fs/bfs: Integer overflow in the BFS parser.

CVE-2024-45779 (opens in a new tab): fs/bfs: Integer overflow leads to Heap OOB Read (Write?) in the BFS parser.

CVE-2024-45780 (opens in a new tab): fs/tar: Integer Overflow causes Heap OOB Write.

CVE-2024-45781 (opens in a new tab): fs/ufs: OOB write in the heap.

CVE-2024-45782 (opens in a new tab): fs/hfs: strcpy() using the volume name (fs/hfs.c:382)

CVE-2024-45783 (opens in a new tab): fs/hfs+: refcount can be decremented twice

CVE-2025-0622 (opens in a new tab): command/gpg: Use-after-free due to hooks not being removed on module unload

CVE-2025-0624 (opens in a new tab): net: Out-of-bounds write in grub_net_search_config_file()

CVE-2025-0677 (opens in a new tab): UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks

CVE-2025-0678 (opens in a new tab): squash4: Integer overflow may lead to heap based out-of-bounds write when reading data

CVE-2025-0684 (opens in a new tab): reiserfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data

CVE-2025-0685 (opens in a new tab): jfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data

CVE-2025-0686 (opens in a new tab): romfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data

CVE-2025-0689 (opens in a new tab): udf: Heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution

CVE-2025-0690 (opens in a new tab): read: Integer overflow may lead to out-of-bounds write

CVE-2025-1118 (opens in a new tab): commands/dump: The dump command is not in lockdown when secure boot is enabled

CVE-2025-1125 (opens in a new tab): fs/hfs: Integer overflow may lead to heap based out-of-bounds write