CVE-2025-0624

What it actually does

Out-of-bounds write in grub2 during network boot caused by grub_strcpy copying a user-controlled environment variable into an undersized internal buffer without length validation, enabling remote code execution on the local network segment and secure boot bypass.

Why it matters to the business

Attackers on the same network segment can compromise systems at boot time, bypass secure boot protections, and gain full control before the operating system loads, potentially affecting entire fleets of machines that rely on network boot.

How an attack unfolds

An attacker on the same network segment sets a maliciously long value in the environment variable that grub2 consults while searching for its configuration file during network boot. grub2 then calls grub_strcpy without accounting for the variable's length, triggering an out-of-bounds write that can be leveraged for remote code execution and secure boot bypass.

How to fix it

Update grub2 to a version that correctly bounds the copy operation when reading environment variables during network boot. Rebuild and re-sign any bootloaders or initramfs images that embed the vulnerable grub2 binary. Restrict network boot traffic to trusted segments and disable PXE/TFTP where not required.

How to confirm the fix worked

Verify that the installed grub2 binary reports a version containing the bounds check fix for the environment-variable copy path. Inspect boot loader source or binary for the corrected allocation size calculation before the grub_strcpy call. Test network boot in an isolated environment to confirm the overflow condition no longer occurs.

Typical attack path

1. Position attacker-controlled system or DHCP/TFTP server on the same network segment as the target boot client
2. Manipulate the environment variable that grub2 reads during netboot configuration file lookup
3. Trigger network boot on the target system so grub2 performs the unsafe grub_strcpy copy
4. Exploit the resulting out-of-bounds write to achieve code execution before the OS kernel loads
5. Use the foothold to disable or bypass secure boot and persist across reboots

How to detect it

Review bootloader and PXE logs for unexpected environment variable values or unusually long strings passed during configuration file retrieval. Look for boot failures or crashes immediately after the network configuration lookup phase on affected systems.

What your security team should do

• Apply the grub2 patch immediately on all systems that perform network boot
• Inventory and prioritize systems using PXE or network boot configurations
• Segment network boot services behind authenticated or physically controlled networks
• Monitor for new grub2 releases and integrate them into the standard patching cycle
• Consider disabling network boot on endpoints that do not require it