Bug 2346116 (CVE-2025-0677)

Summary: CVE-2025-0677 grub2: UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in grub2. When performing a symlink lookup, the grub's UFS module checks the inode's data size to allocate the internal buffer to read the file content, however, it fails to check if the symlink data size has overflown. When this occurs, grub_malloc() may be called with a smaller value than needed. When further reading the data from the disk into the buffer, the grub_ufs_lookup_symlink() function will write past the end of the allocated size. An attack can leverage this by crafting a malicious filesystem, and as a result, it will corrupt data stored in the heap, allowing for arbitrary code execution used to by-pass secure boot mechanisms.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2025-02-18   

Description OSIDB Bzimport 2025-02-17 15:07:05 UTC 
When performing a symlink lookup the grub's UFS module check the inode's data size to allocate the internal buffer for reading the file content however it misses to check if the symlink data size has overflown. If that happens grub_malloc() may be called with a smaller value than needed, as consequence when further reading the data from disk into the buffer grub_ufs_lookup_symlink() function will write past the end of the allocated size. An attack may leverage that by crafting a malicious filesystem and as a result it will corrupt data stored in the heap, it's possible that arbitrary code execution may be achieved through it and to be used to by-pass secure boot mechanisms.
Comment 2 errata-xmlrpc 2025-05-13 08:41:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:6990 https://access.redhat.com/errata/RHSA-2025:6990