CVE-2025-1118

Published: Feb 19, 2025Modified: Jun 30, 2026Deferred

4.4

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 0.8 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory.

Related CWEs

CWE-501

Trust Boundary Violation

The product mixes trusted and untrusted data in the same data structure or structured message.

References (5)

https://access.redhat.com/errata/RHSA-2025:16154

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2025-1118

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2346137

Source: secalert@redhat.com

https://git.savannah.gnu.org/cgit/grub.git/commit/?id=34824806ac6302f91e8cabaa41308eaced25725f

Source: secalert@redhat.com

https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html

Source: secalert@redhat.com

Timeline

No history available yet.