CVE-2025-0624

CVE-2025-0624 is a heap buffer overflow vulnerability in the GRUB2 bootloader, specifically in the function grub_net_search_config_file(). During network boot (PXE), GRUB2 copies user-controlled environment variable data into a fixed-size internal buffer using grub_strcpy() without validating the length of the source string. This results in an out-of-bounds write beyond the allocated buffer [1][2].

The attack surface is the network boot process; an attacker must be on the same network segment as the target system and control the DHCP or TFTP server that provides the boot configuration. No authentication is required because the environment variable is supplied during the PXE handshake. By crafting an overly long environment variable, the attacker can overflow the heap buffer [1].

Successful exploitation allows remote code execution within the GRUB2 context before the operating system loads. Since GRUB2 runs before Secure Boot verification, this can be used to bypass Secure Boot protections and execute arbitrary, unverified code [1].

Red Hat has released updated packages for OpenShift Container Platform versions 4.15.50, 4.16.38, 4.17.23, and 4.18.8 that include patches for this vulnerability [1][2][3][4]. No workarounds are documented; applying the update is the recommended action.