Symlink Lookup Vulnerability in GRUB2 by Red Hat

CVE-2025-0677

Summary

A flaw in GRUB2 arises during symlink lookups in its UFS module, where the system fails to correctly check for symlink data size overflow. This oversight can result in grub_malloc() being invoked with insufficient allocated memory. Consequently, the grub_ufs_lookup_symlink() function may overwrite memory bounds, resulting in heap corruption. Attackers could exploit this vulnerability by crafting malicious filesystems, enabling arbitrary code execution and potentially circumventing secure boot protections.

References