Integer Overflow Vulnerability in HFS Filesystem Module of GRUB
CVE-2025-1125

6.7MEDIUM

Key Information:

Vendor

Gnu
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
3 March 2025

What is CVE-2025-1125?

The GRUB bootloader's HFS filesystem module contains a security issue where it fails to adequately check for integer overflows during buffer size calculations using metadata from the filesystem. This flaw can be exploited by manipulating the filesystem to trigger an overflow, potentially allowing attackers to execute arbitrary code. Such exploitation could undermine secure boot mechanisms and lead to serious compromises of system integrity.

References

https://access.redhat.com/security/cve/CVE-2025-1125
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2346138
issue-trackingx_refsource_REDHAT
https://lists.gnu.org/archive/html/grub-devel/2025-02/msg...

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.