LUKS-Encrypted Disk Vulnerability in GRUB by Red Hat

CVE-2025-4382

Summary

A security flaw exists in systems that utilize LUKS-encrypted disks configured with GRUB for TPM-based auto-decryption. When GRUB automatically decrypts disks using keys stored in TPM, it loads the decryption key into memory. An attacker with physical access can manipulate the filesystem superblock, causing GRUB to fail in locating a valid filesystem, and enter rescue mode. As a result, the disk remains decrypted, exposing the decryption key in system memory. This enables unauthorized access to unencrypted data without authentication, raising significant concerns regarding data confidentiality and integrity.

References