CVE-2024-2312

2024-04-0805:50:52

redhat.com

access.redhat.com

grub2

flaw

uefi

secure boot bypass

use-after-free

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

15.5%

JSON

A flaw was found in GRUB2. GRUB2 do not call the module fini functions on exit, leading to Debian/Ubuntu’s peimage GRUB2 module leaving the UEFI system table hooks after exit. This issue leads to a use-after-free condition, possibly leading to a secure boot bypass.