CVE-2020-25632 is a use-after-free vulnerability in GRUB2 versions prior to 2.06, specifically affecting products from Fedora Project, GNU, NetApp, and Red Hat. This flaw allows a privileged local attacker to unload a module that is still a dependency for another, potentially leading to arbitrary code execution or Secure Boot bypass. With a CVSS score of 8.2 (HIGH), it poses a significant threat to data confidentiality, integrity, and system availability. While no public exploit code or active exploitation has been observed, the vulnerability has garnered some community discussion and media coverage, indicating awareness within the cybersecurity community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.06CPE matchmatch criteria | cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | ||
7.2CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:* | ||
7.3CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Mar 9, 2021grub2: Use-after-free in rmmod command
Mar 2, 2021