Bug 2346120 (CVE-2025-0685) - CVE-2025-0685 grub2: jfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
Summary: CVE-2025-0685 grub2: jfs: Integer overflow when handling symlinks may lead to...
Keywords:
Status: NEW
Alias: CVE-2025-0685
Deadline: 2025-02-18
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-02-17 15:28 UTC by OSIDB Bzimport
Modified: 2025-02-19 17:55 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-02-17 15:28:36 UTC
When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffers size, however it misses to properly check for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculation to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result the grub_jfs_lookup_symlink() function will write past of the internal buffer length during grub_jfs_read_file(). This flaw may be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution by-passing secure boot protections.


Note You need to log in before you can comment on or make changes to this bug.