Skip to main content

CVE-2025-0622

MEDIUM
Use After Free (CWE-416)
2025-02-18 secalert@redhat.com
RCE Memory Corruption Use After Free
6.4
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
SUSE
MEDIUM
qualitative
Red Hat
6.4 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 24, 2026 - 23:22 vuln.today
CVE Published
Feb 18, 2025 - 20:15 nvd
MEDIUM 6.4

DescriptionCVE.org

A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw allows an attacker to force grub2 to call the hooks once the module that registered it was unloaded, leading to a use-after-free vulnerability. If correctly exploited, this vulnerability may result in arbitrary code execution, eventually allowing the attacker to bypass secure boot protections.

AnalysisAI

GRUB2 bootloader fails to properly unload module-registered hooks during module unloading, creating a use-after-free condition that allows privileged local attackers to execute arbitrary code and potentially bypass secure boot protections. The vulnerability affects GRUB2 across multiple distributions including Red Hat Enterprise Linux and SUSE Linux Enterprise, with patch availability confirmed through multiple security advisories issued in early 2025. No public exploit code or active exploitation in the wild has been confirmed at time of analysis.

Technical ContextAI

The vulnerability resides in the GRUB2 command/gpg module implementation, which manages cryptographic operations during boot. GRUB2's modular architecture allows runtime loading and unloading of functional modules; each module can register callback hooks with the bootloader's hook system. The flaw stems from incomplete cleanup logic in the module unload pathway-when a module is removed from memory, its registered hooks remain in the hook registry pointing to now-freed memory locations. CWE-416 (Use After Free) categorizes this as a memory safety violation where freed memory is subsequently dereferenced. The attack surface is confined to the boot environment where an attacker with high privilege (root or firmware access) can trigger module unloading followed by hook invocation, resulting in execution of arbitrary code at the bootloader privilege level. This is particularly critical because GRUB2 executes before operating system kernel initialization and before secure boot verification completion.

Affected ProductsAI

Red Hat Enterprise Linux is affected across multiple versions with patches released via RHSA-2025:16154 and RHSA-2025:6990. SUSE Linux Enterprise is affected across multiple product lines with patches released via SUSE-SU-2025:01961, SUSE-SU-2025:0586, SUSE-SU-2025:0587, SUSE-SU-2025:0588, SUSE-SU-2025:0607, SUSE-SU-2025:0629, SUSE-SU-2025:20511, SUSE-SU-2025:20863, and SUSE-SU-2025:14822. The underlying affected software is GNU GRUB2 with module management functionality; specific version ranges are documented in the referenced vendor security advisories. CPE string cpe:2.3:a:gnu:grub2 matches the core affected software. Fedora and other distributions shipping GRUB2 may also be affected pending their advisory releases.

RemediationAI

Apply vendor-released security patches immediately through official distribution channels: for Red Hat Enterprise Linux, install updates referenced in RHSA-2025:16154 and RHSA-2025:6990; for SUSE Linux Enterprise, apply updates from the corresponding SUSE-SU advisories listed in the vulnerability references. The patches resolve the module hook cleanup logic to properly deregister hooks during module unloading. If immediate patching is not feasible, restrict physical or remote firmware access to GRUB2 configuration and module loading mechanisms to trusted administrators only, and disable non-essential GRUB2 modules that are not required for boot. Monitor boot logs and secure boot status indicators for any anomalies suggesting exploitation attempts. Organizations managing large fleets should prioritize patching production systems in security-sensitive environments (financial services, critical infrastructure, high-assurance computing) first, as these face elevated supply chain compromise risks.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.30 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.40 Affected
Container suse/sle-micro-rancher/5.2:latest Image SLES15-SP3-BYOS-Azure Image SLES15-SP3-BYOS-GCE Image SLES15-SP3-HPC-BYOS-Azure Image SLES15-SP3-HPC-BYOS-GCE Image SLES15-SP3-Micro-5-2-BYOS-Azure Image SLES15-SP3-Micro-5-2-BYOS-GCE Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAP-BYOS-Azure Image SLES15-SP3-SAP-BYOS-GCE Image SLES15-SP3-SAPCAL-Azure Image SLES15-SP3-SAPCAL-GCE Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:latest Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-Azure Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-SAP-CCloud Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-GCE Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-GCE Image SLES15-SP4-Manager-Proxy-4-3-BYOS Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP4-SAP-BYOS-Azure Image SLES15-SP4-SAP-BYOS-GCE Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAP-Hardened Image SLES15-SP4-SAP-Hardened-Azure Image SLES15-SP4-SAP-Hardened-BYOS-Azure Image SLES15-SP4-SAP-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Hardened-GCE Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-GCE Affected

Share

CVE-2025-0622 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy