CVE-2025-1118

Impact

A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

References

• NVD record
• CVE.org record
• https://access.redhat.com/errata/RHSA-2025:16154
• https://access.redhat.com/security/cve/CVE-2025-1118
• https://bugzilla.redhat.com/show_bug.cgi?id=2346137
• https://git.savannah.gnu.org/cgit/grub.git/commit/?id=34824806ac6302f91e8cabaa41308eaced25725f
• https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html