CVE-2020-14372

CVE-2020-14372：用一个“简单把戏”绕过（并非那么）安全启动 漏洞详情 有一天我在GRUB2的控制台输入"help"，看到了一些非常“有趣”的命令： readbyte ADDR: 从ADDR读取8位值 writebyte ADDR VAL: 将8位值VAL写入ADDR 我立刻以为我找到了最有趣的安全启动绕过方法，但在安全启动下这些命令会输出如下内容： root@kitploit: error: Secure Boot forbids loading module .../memrw.mod...

shim-review

此仓库用于审查签名 shim 的请求。要创建审查请求： 克隆此仓库（最好 fork） 编辑下面的模板 添加要签名的 shim.efi 添加构建日志 添加可能需要的任何附加二进制文件/证书/SHA256 哈希 提交所有这些内容 使用格式为 "myorg-shim-arch-YYYYMMDD" 的标签进行标记 推送到 GitHub 在 https://github.com/rhboot/shim-review/issues 提交一个 issue，并附上你的标签链接 当你的 issue 被添加 "accepted" 标签时，即表示已获批准 请注意，我们实际上只对在 Linux 上使用 GRUB...

Super-UEFIinSecureBoot-Disk

Super UEFIinSecureBoot Disk Super UEFIinSecureBoot Disk es una prueba de concepto no mantenida ni mejorada activamente imagen de arranque con el cargador de arranque GRUB2 diseñada para ser utilizada como base para unidades flash USB de recuperación. Característica clave: el disco es completament...

CVE-2025-0690

CVE-2025-0690: GRUB2 整数オーバーフロー脆弱性 🛡️ 概要 CVE-2025-0690 は、ブートローダ GRUB2 における重大な整数オーバーフロー 脆弱性であり、任意のコード実行 とSecure Boot の回避 を許します。この欠陥は GRUB2 に依存してセキュアブートを行うシステムに影響し、オペレーティングシステム起動前のシステムを危険にさらします。 🔍 技術的詳細 根本原因 脆弱なコマンド : read（キーボード入力の受信に使用） 問題 : 入力長が 32ビット整数 に格納される 悪用メカニズム : 極めて長いテキスト行を入力する 長さ変数でオーバーフロー...

slot2

slot2 slot2: a two-stage UEFI GRUB2 bootkit that persists a pre-OS networked implant on Amazon Linux 2023 on AWS EC2 UEFI x8664. by cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/slot2 Summary slot2 is a bootkit for Amazon Linux 2023 on EC2. The AWS EC2 UEFI firmware load...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module that serves as a dependency without checking whether any other dependent modules are still loaded, leading to a “use-after-free” scenario. This could allow arbitrary code to be...

Astra Linux – Vulnerability in grub2

Integer underflow in grubnetrecvip4packets; A malicious IP packet can cause an integer underflow in the grubnetrecvip4packets function, affecting the rsm-totallen value. Under certain circumstances, the totallen value may wrap around to a small integer number, which will be used in memory...

Astra Linux – Vulnerability in grub2

A vulnerability related to operations after freeing memory has been discovered in GRUB’s gettext module. This flaw arises from a programming error where the gettext command remains registered in memory even after its associated module is unloaded. An attacker can exploit this condition by invokin...

Astra Linux – Vulnerability in grub2

The GRUB2’s shimlock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules being loaded in GRUB2, thereby breaking the secure boot trust-chain...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2 in versions prior to 2.06. The Setparamprefix function in the menu rendering code performs a length calculation based on the assumption that expressing a single quoted character would require 3 characters. However, in reality, it requires 4 characters. This allows a...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2. When attempting to mount an HFS+ partition, the hfsplus filesystem driver does not correctly set the ERRNO value. This issue may lead to a NULL pointer access...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2, where the grubextcmddispatcher function calls grubarglistalloc to allocate memory for the grub’s argument list. However, it does not check in case the memory allocation fails. Once the allocation fails, a NULL pointer will be processed by the parseoption function,...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2. During the network boot process, when attempting to search for the configuration file, grub copies data from a user-controlled environment variable into an internal buffer using the grubstrcpy function. During this step, it fails to consider the length of the...

Astra Linux – Vulnerability in grub2

A crafted 16-bit grayscale PNG image may lead to an out-of-bounds write in the heap area. An attacker may exploit this to cause heap data corruption or, ultimately, arbitrary code execution and circumvent secure boot protections. This issue is highly complex to exploit; an attacker needs to perfo...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking, allowing a privileged attacker to remove address ranges from memory. This creates an opportunity to circumvent SecureBoot protections after proper analysis of grub’s memory layout. The...

Astra Linux – Vulnerability in grub2

A buffer overflow was detected in grubfontconstructglyph. A maliciously crafted pf2 font can cause an overflow when calculating the maxglyphsize value. This results in allocating a buffer that is smaller than necessary for the glyph, leading to another buffer overflow and an out-of-bounds write t...

Astra Linux – Vulnerability in grub2

A heap out-of-bounds write may occur during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. The impacts on confidentiality, integrity, and availability are considered low, as it is very complex for an attacker to control the encoding and...

Astra Linux – Vulnerability in grub2

When reading data from the disk, the GRUB’s UDF filesystem module uses the user-controlled data length metadata to allocate its internal buffers. In certain scenarios, while iterating through disk sectors, it assumes that the read size from the disk is always smaller than the allocated buffer siz...

Photon OS 5.0: Grub2 PHSA-2026-5.0-91-0742

An update of the grub2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0742. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Grub2 PHSA-2026-5.0-92-0742

An update of the grub2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0742. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...