NIXPKGS-2025-0019
published on 18 Dec 2025
Permalink
CVE-2025-54771
4.9 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): HIGH
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): LOW
- Availability impact (A): LOW
by @LeSuisse Activity log
- Created automatic suggestion
-
@LeSuisse
removed
2 packages
- grub2_pvgrub_image
- grub2_pvhgrub_image
- @LeSuisse removed maintainer @SigmaSquadron
-
@LeSuisse
added
2 maintainers
- @hehongbo
- @digitalrane
-
@LeSuisse
removed
2 maintainers
- @hehongbo
- @digitalrane
- @LeSuisse accepted
- @LeSuisse published on GitHub
Grub2: use-after-free in grub_file_close()
A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
References
- http://www.openwall.com/lists/oss-security/2025/11/18/3
- RHBZ#2413823 issue-tracking x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-54771 x_refsource_REDHAT vdb-entry
- https://access.redhat.com/security/cve/CVE-2025-54771 x_refsource_REDHAT vdb-entry
- RHBZ#2413823 issue-tracking x_refsource_REDHAT
- http://www.openwall.com/lists/oss-security/2025/11/18/3
- https://access.redhat.com/security/cve/CVE-2025-54771 x_refsource_REDHAT vdb-entry
- RHBZ#2413823 issue-tracking x_refsource_REDHAT
- http://www.openwall.com/lists/oss-security/2025/11/18/3
Affected products
grub2
- =<2.14
rhcos