Bug 2548192

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.

The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command (grub-core/term/serial.c and grub-core/term/ns8250.c). When the serial command is invoked with --port=mmio,<address>.q, the supplied 64-bit address is passed directly to the serial MMIO driver without verifying that it falls within a legitimate UART resource, rather than ordinary RAM. Neither the serial command nor the lockdown-available gdbinfo command (which can be used to recover the loaded image base) is restricted under lockdown.

By pointing the serial MMIO base at the address of GRUB's grub_file_verifiers list head and triggering UART initialization (e.g. via a subsequent terminal_input/serial input poll), the fixed, UART-derived initialization register stores (IER, LCR, DLL, DLM, FCR, MCR) clear that list head. GRUB's file-open path treats an empty verifier list as "no verifiers registered" and fails open, admitting unsigned native GRUB modules while lockdown continues to report as active. This is a caller-selected destination with fixed, UART-derived values rather than an arbitrary-value write; closest root-cause mapping is CWE-822 (Untrusted Pointer Dereference).

Exploitation requires: an attacker-controlled or attacker-selectable GRUB boot configuration source, continued shim/SBAT admission of the affected signed GRUB image, a structurally valid unsigned native GRUB module, knowledge of the loaded image's placement in memory, and the ability to trigger a serial input poll. Administrator-controlled boot configuration or attacker-controlled removable media are representative routes; root or physical access alone does not satisfy every prerequisite, and this is not a remote or ordinary-user vector.

The flaw was reproduced against the Canonical-signed grub-efi-amd64-signed 1.215+2.14-2ubuntu1 package (gcdx64.efi.signed, underlying build grub2 2.14-2ubuntu1) in an enforcing QEMU/OVMF environment with Microsoft UEFI CA and Ubuntu shim 15.8. The affected serial MMIO code path is present generically in upstream GRUB wherever ns8250 MMIO serial support is compiled in; the researcher did not confirm reproduction on other signed builds, distributions, or architectures.

This issue is conceptually related to, but distinct from, CVE-2025-0622 ("Grabit"), which corrupts/nulls grub_file_verifiers via a use-after-free and relies on the same fail-open empty-verifier-list behavior; and to CVE-2022-28735, a prior GRUB verifier-bypass precedent.