Database/Firmware, BMC & network fabric
GRUB2: Buffer overflow in `grub.cfg` parsing allowing Secure Boot bypass and arbitrary code execution inside GRUB
Impact
Buffer overflow in grub.cfg parsing allowing Secure Boot bypass and arbitrary code execution inside GRUB — a bootkit that persists across OS reinstall
Who can reach it
Local, or via a modified PXE-boot network
What to do
dbx (Secure Boot revocation list) push plus a coordinated GRUB/shim/kernel update. The dbx push is the dangerous part: revoking the old shim before every node has the new bootloader leaves the node unbootable, and recovery is out-of-band console work per node
Fleet impact
How widespread
universal - GRUB2 + the Microsoft-signed shim is the boot path for nearly every Linux GPU node
Cost to remediate
node-reboot + firmware-flash-class pain: patching GRUB is easy, but the real fix is a **dbx revocation** update pushed into UEFI NVRAM on every node, and a botched dbx push makes the node unbootable - which is why operators delay it for years
Why it hits the whole fleet
A config-file buffer overflow in GRUB2 lets attackers run pre-OS bootkits with Secure Boot enabled; because every old signed GRUB stays valid until revoked, the fleet remains exploitable until each node's firmware revocation list is updated.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.