CVE-2025-0684
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A flaw in GRUB2's reiserfs module allows integer overflow during symlink buffer size calculation, leading to heap out-of-bounds write and potential arbitrary code execution.
Risk Assessment
An attacker could bypass Secure Boot protections and compromise the boot process, threatening system integrity and data confidentiality.
Recommendation
Immediately update GRUB2 to a patched version addressing CVE-2025-0684. Restrict physical access to media that may contain a malicious reiserfs filesystem.
Original NVD description (English source)
A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the grub_reiserfs_read_symlink() will call grub_reiserfs_read_real() with a overflown length parameter, leading to a heap based out-of-bounds write during data reading. This flaw may be leveraged to corrupt grub's internal critical data and can result in arbitrary code execution, by-passing secure boot protections.