CVE-2025-0689

Katalog CVE

CVSS 7.8 · High EPSS 0,48%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada gnu grub2. Skor CVSS 3.1 7.8 (High) menurut redhat.com.

Deskripsi (NVD)

When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buffers. In certain scenarios, while iterating through disk sectors, it assumes the read size from the disk is always smaller than the allocated buffer size which is not guaranteed. A crafted filesystem image may lead to a heap-based buffer overflow resulting in critical data to be corrupted, resulting in the risk of arbitrary code execution by-passing secure boot protections.

Rincian

Terbit di NVD

3 Maret 2025

Terakhir diubah

30 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html mailing list · advisory vendor
• https://access.redhat.com/security/cve/CVE-2025-0689 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2346122 issue tracking · advisory pihak ketiga