CVEvulnerability
CVE-2025-0622
6.4 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2025-02-18
- Last modified
- 2026-10-21
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.4 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-416
Description
A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw allows an attacker to force grub2 to call the hooks once the module that registered it was unloaded, leading to a use-after-free vulnerability. If correctly exploited, this vulnerability may result in arbitrary code execution, eventually allowing the attacker to bypass secure boot protections.
Related
Weakness · CWE (1)
- CWE-416 Use After Free weakness
References
- https://access.redhat.com/errata/RHSA-2025:16154 access.redhat.com
- https://access.redhat.com/errata/RHSA-2025:6990 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2025-0622 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2345865 bugzilla.redhat.com
- https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html lists.gnu.org