CVE-2024-2312

What it actually does

GRUB2 fails to invoke module fini functions during exit, allowing the peimage module on Debian/Ubuntu systems to retain UEFI system table hooks and trigger a use-after-free condition that may enable secure boot bypass.

Why it matters to the business

Local or physical attackers could load unauthorized code during the boot process on affected Linux systems, undermining firmware-level protections and increasing risk of persistent compromise; the issue has been public for over two years with negligible observed exploitation.

How an attack unfolds

An attacker with local or physical access loads or triggers the vulnerable peimage module in GRUB2, forces an exit without fini cleanup, then reuses the dangling UEFI hooks via the resulting use-after-free to inject code that bypasses secure boot verification.

How to fix it

Upgrade GRUB2 packages to versions that correctly invoke module fini functions on exit; rebuild and re-sign bootloaders if custom GRUB2 builds are in use.

How to confirm the fix worked

Inspect GRUB2 source for proper fini registration and test boot sequences on patched UEFI systems to confirm hooks are released; verify module unload behavior in logs or via debugging tools.

Typical attack path

1. Obtain local or physical access to the target system
2. Trigger or supply the peimage GRUB2 module
3. Force GRUB2 exit without module cleanup
4. Reuse freed UEFI system table hooks to inject malicious boot code
5. Bypass secure boot and load unauthorized kernel or bootloader

How to detect it

Review system boot logs and GRUB2 module load/unload events for anomalies around exit sequences; examine UEFI variable or hook persistence after GRUB2 termination.

What your security team should do

• Apply GRUB2 updates from distribution vendors immediately on all Debian and Ubuntu UEFI systems
• Audit boot configurations for use of the peimage module
• Enable measured boot or additional firmware protections where possible
• Monitor EPSS and KEV updates for any future increase in exploit activity