GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.

Vulnerability

Integer overflow vulnerabilities exist in the functions grub_cmd_initrd and grub_initrd_init within the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (this functionality is not included in upstream GRUB2) [1][2][3]. The overflow occurs when handling an extremely large number of arguments to the initrd command on 32-bit architectures, or when processing a crafted filesystem with very large files on any architecture [description]. This leads to a heap-based buffer overflow. Affected versions include GRUB2 version 2.04 and prior [description].

Exploitation

An attacker requires either local administrative privileges or physical access to the system to trigger the vulnerability [1][3]. On 32-bit systems, the attacker can supply an extremely large number of arguments to the initrd command. On any architecture, the attacker can craft a filesystem containing very large files that, when processed by GRUB2, cause the integer overflow. The overflow results in a heap-based buffer overflow, allowing the attacker to inject malicious payload [1][2].

Impact

Successful exploitation allows arbitrary code execution within the GRUB2 bootloader, bypassing UEFI Secure Boot restrictions [1][2][3]. The attacker can install persistent bootkits or malicious bootloaders, gaining near-total control over the victim device [1]. This compromises the integrity of the boot chain and can lead to full system compromise.

Mitigation

Fixed versions have been released by affected distributions: Ubuntu [2], Red Hat [3], and Debian. Users should update their grub2 packages to the latest patched versions. Additionally, new signed bootloaders must be deployed and vulnerable bootloaders revoked to prevent adversaries from using older versions [1]. There is no workaround for the flaw [3]. The vulnerability is part of the "BootHole" set of CVEs, and mitigation requires coordinated updates across the ecosystem [1][4].