GRUB2 (script function redefinition): Use-after-free when a GRUB script redefines a function while that function

Impact

Use-after-free when a GRUB script redefines a function while that function is executing. Gives arbitrary code execution in the bootloader from nothing more than a modified grub.cfg, which on most distros is not itself signature-checked.

Who can reach it

Anyone who can write grub.cfg - local root, or a previous bare-metal tenant. This is the classic BootHole shape: config file trusted more than it deserves.

What to do

grub2 package update + reboot per node. Also worth checking that grub.cfg is not writable from a tenant-reachable partition on your image layout.

References