GRUB2 (cutmem command): The cutmem command was not gated by Secure Boot lockdown, so a privileged user could carve

Impact

The cutmem command was not gated by Secure Boot lockdown, so a privileged user could carve memory regions out of the map GRUB hands the kernel. Used to remove the regions that hold verification state, which downgrades a verified boot to an unverified one without tripping anything.

Who can reach it

Local privileged user at the GRUB shell.

What to do

grub2 package update + reboot. This is the lockdown-coverage class of bug: the fix is that the command is now refused when Secure Boot is on, so there is no config workaround short of a GRUB password.

References