NIXPKGS-2025-0019
published on
Permalink
CVE-2025-54771
4.9 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): Low (L)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): Low (L)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
2 packages
- grub2_pvgrub_image
- grub2_pvhgrub_image
- @LeSuisse deleted maintainer @SigmaSquadron maintainer.delete
-
@LeSuisse
added
maintainer.add
2 maintainers
- @hehongbo
- @digitalrane
-
@LeSuisse
deleted
maintainer.delete
2 maintainers
- @hehongbo
- @digitalrane
- @LeSuisse accepted
- @LeSuisse published on GitHub
Grub2: use-after-free in grub_file_close()
A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
References
Affected products
grub2
- =<2.14
rhcos
Ignored packages (2)
pkgs.grub2_pvgrub_image
PvGrub2 image for booting PV Xen guests
pkgs.grub2_pvhgrub_image
PvGrub2 image for booting PVH Xen guests