Description (CNA)
GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Debian / Debian based GNU GRUB | affected 0 before 2.12-1ubuntu5 |
CWE
No CWE identifiers supplied.
References
- https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2312
- https://security.netapp.com/advisory/ntap-20240426-0003/
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.