CVE-2024-49504

What it actually does

The flaw permits attackers who reach the GRUB shell to bypass disk encryption and read files from encrypted volumes.

Why it matters to the business

Encrypted data on affected systems can be read by anyone who gains physical access during boot, increasing the chance of sensitive information exposure on legacy deployments.

How an attack unfolds

An attacker with physical access interrupts the boot process to reach the GRUB shell, then issues commands that mount and read files from encrypted partitions without supplying the decryption passphrase.

How to fix it

Upgrade the affected qemu package on Ubuntu 14.04 LTS to version 2.0.0+dfsg-2ubuntu1.24 or newer.

How to confirm the fix worked

Confirm the installed package version is at or above the fixed release and verify that GRUB shell commands can no longer access encrypted disk contents without the passphrase.

Typical attack path

1. Obtain physical access to the target machine
2. Interrupt the boot sequence to enter the GRUB shell
3. Issue GRUB commands to locate and access encrypted disk contents
4. Extract files or data from the encrypted volumes

How to detect it

Examine boot logs and GRUB command history for unexpected shell sessions or attempts to access encrypted partitions; correlate with file-access timestamps outside normal maintenance windows.

What your security team should do

• Apply the listed package update on all Ubuntu 14.04 LTS systems
• Limit physical access to servers and workstations
• Disable interactive GRUB shell access where operationally feasible