medium6.7
CVE-2024-2312
GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit.
Impact
GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gnu | Grub2 | before 2.12-1ubuntu5 |
| Netapp | Bootstrap Os | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2312
- https://security.netapp.com/advisory/ntap-20240426-0003/
- https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2312
- https://security.netapp.com/advisory/ntap-20240426-0003/