CVE-2025-0690
March 5, 2025, 9:15 p.m.
6.1
Medium
Description
The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to reallocate the line buffer to accept the next character. During this process, with a line big enough it's possible to make this variable to overflow leading to a out-of-bounds write in the heap based buffer. This flaw may be leveraged to corrupt grub's internal critical data and secure boot bypass is not discarded as consequence.
Product(s) Impacted
| Product | Versions |
|---|---|
| GRUB |
|
Weaknesses
CWE-787
Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Tags
CVSS Score
CVSS Data
- Attack Vector: PHYSICAL
- Attack Complexity: LOW
- Privileges Required: HIGH
- Scope: UNCHANGED
- Confidentiality Impact: HIGH
- Integrity Impact: HIGH
- Availability Impact: HIGH
View Vector String
CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Date
- Published: Feb. 24, 2025, 8:15 a.m.
- Last Modified: March 5, 2025, 9:15 p.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
secalert@redhat.com
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.