GRUB2 (rmmod command): Use-after-free in the rmmod command

CVE-2020-25632Firmware, BMC & network fabriccurated

Impact

Use-after-free in the rmmod command. Unloading a module whose dependencies are still live leaves dangling pointers GRUB will later call through, which is a clean primitive for arbitrary pre-boot execution and another Secure Boot bypass.

Who can reach it

Local, via GRUB command line or a controlled grub.cfg. On a bare-metal fleet, any tenant who had console or root on the node.

What to do

grub2 package update + reboot per node. If you leave the GRUB command line unlocked on your image, set a GRUB password as a stopgap - it does not fix the bug but it removes the easiest path to it.

References

https://nvd.nist.gov/vuln/detail/CVE-2020-25632 https://access.redhat.com/security/cve/CVE-2020-25632

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.