Skip to main content

CVE-2025-1118

MEDIUM
Trust Boundary Violation (CWE-501)
2025-02-19 secalert@redhat.com
Information Disclosure
4.4
CVSS 3.1 · Vendor: redhat
View

Vulnerability Assessment

Weakness
CWE
CWE-501
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V14 - Data Protection Trust boundary enforcement
Impact

The risk assessment reveals a disconnect between severity metrics and real-world exploitability. While CVSS 4.4 denotes a medium confidentiality impact, the EPSS score of 0.05% (14th percentile) indicates very low probability of exploitation in the wild, suggesting that despite the technical vulnerability, practical exploitation remains rare. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) confirms that exploitation requires local access and high privileges, substantially limiting the attack surface-most adversaries with high privileges on a system already possess means to access sensitive data through other channels. The absence of either a public proof-of-concept or CISA KEV active exploitation confirmation further supports the low real-world risk profile. Under SSVC decision framework, this vulnerability exhibits: exploitation status of unproven (no public POC), automatable false (requires privileged access and physical/virtual machine restart), and technical impact of high (memory confidentiality). The combination suggests this is a defense-in-depth issue important for hardened environments (Secure Boot systems, TPM-protected infrastructure) but not a critical priority for standard deployments. Organizations should prioritize patching for systems where bootloader integrity is a documented security requirement, while standard systems may defer to regular patch cycles.
Exploit ScenarioDerived

A privileged administrator with high-level access to a hardened system (one with Secure Boot enabled and lockdown protections active) could invoke the GRUB dump command at the bootloader prompt during system startup to read kernel memory directly. By examining memory dumps, the attacker could extract cryptographic signatures used for kernel verification, salt values for key derivation, or other secrets stored in early-boot kernel structures before the operating system's full security mechanisms activate. While this requires already-elevated privileges and physical/virtual access to the bootloader prompt (not a network-exploitable scenario), it represents a privilege escalation and information disclosure risk for environments where bootloader security is relied upon as a defense boundary against insider threats or compromised administrators.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 24, 2026

GRUB2 bootloader fails to enforce lockdown mode restrictions on the dump command, allowing local privileged users to read arbitrary memory contents and extract sensitive cryptographic material including signatures, salts, and other secrets. Grub2 is affected across multiple Linux distributions including Red Hat Enterprise Linux and SUSE Linux Enterprise. The vulnerability carries a CVSS score of 4.4 with a low EPSS exploitation probability of 0.05% (14th percentile), indicating limited real-world attack likelihood despite the information disclosure impact. No public exploit code or active exploitation has been identified at time of analysis.

RemediationAI

Apply vendor-supplied patches immediately for production systems where Secure Boot or bootloader integrity is enforced. For Red Hat Enterprise Linux systems, apply updates referenced in RHSA-2025:16154 (https://access.redhat.com/errata/RHSA-2025:16154). For SUSE Linux Enterprise, apply the appropriate updates from the SUSE security advisories matching your product line (SUSE-SU-2025:01961 for SLE 15 SP5, SUSE-SU-2025:0586 for SLE 12 SP5, and corresponding advisories for other SLE versions). The upstream GRUB fix is available in the referenced commit and should be included in distribution kernel and bootloader updates. For systems where immediate patching is not feasible, restrict physical or virtual console access to trusted administrators only, ensure Secure Boot remains enabled to prevent bootloader downgrade attacks, and audit system access logs for unauthorized bootloader access attempts. Verify patch application by confirming GRUB2 version updates in your distribution and testing that lockdown mode restrictions are properly enforced (consult distribution documentation for lockdown mode verification procedures).

Affected ProductsAI

GRUB2 is affected across multiple distributions with confirmations from both Red Hat and SUSE. Red Hat Enterprise Linux systems are covered under advisory RHSA-2025:16154 and CVE tracking at https://access.redhat.com/security/cve/CVE-2025-1118. SUSE Linux Enterprise is affected across multiple product lines with patches available in advisories SUSE-SU-2025:01961, SUSE-SU-2025:0586, SUSE-SU-2025:0587, SUSE-SU-2025:0588, SUSE-SU-2025:0607, SUSE-SU-2025:0629, SUSE-SU-2025:20511, SUSE-SU-2025:20863, and SUSE-SU-2025:14822. The upstream GRUB project confirmed the issue via commit 34824806ac6302f91e8cabaa41308eaced25725f (https://git.savannah.gnu.org/cgit/grub.git/commit/?id=34824806ac6302f91e8cabaa41308eaced25725f) with discussion at https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html. Specific version ranges and CPE strings are referenced in the Red Hat bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2346137.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GRUB2 is the bootloader used by most Linux distributions to load the kernel during system startup. The vulnerability stems from improper access control enforcement (CWE-501: Trust Boundary Violation) where the dump command, which is designed for debugging and memory inspection, remains accessible when GRUB enters lockdown mode-a security hardening feature that restricts dangerous operations. Lockdown mode is typically activated on systems with Secure Boot or other integrity protections to prevent unauthorized firmware or bootloader modifications. The root cause involves the dump command not being included in the list of operations that should be blocked during lockdown, creating a gap in the security boundary that separates privileged bootloader operations from restricted ones. An attacker with high-level privileges (PR:H in CVSS vector) can leverage this gap to directly read kernel memory at boot time before standard operating system protections are in place.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
SUSE MEDIUM
Red Hat 4.4 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Feb 19, 2025 - 18:15 nvd
MEDIUM 4.4

DescriptionCVE.org

A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory.

Executive ViewAI

Why It Matters

Organizations using A flaw should be aware of moderate risk from CVE-2025-1118 rated CVSS 4.4. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score
0.0%
Top 86% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Low

Priority Score

22
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +22
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-501 – Trust Boundary Violation

View all
CVE-2024-23682 HIGH POC
8.2
CVE-2026-25725 CRITICAL
10.0
CVE-2020-4077 CRITICAL
9.9
CVE-2022-1799 CRITICAL
9.8
CVE-2026-65902 MEDIUM POC
5.3
CVE-2020-4076 CRITICAL
9.0
CVE-2026-44091 HIGH
8.8
CVE-2024-49050 HIGH
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.30 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.40 Affected
Container suse/sle-micro-rancher/5.2:latest Image SLES15-SP3-BYOS-Azure Image SLES15-SP3-BYOS-GCE Image SLES15-SP3-HPC-BYOS-Azure Image SLES15-SP3-HPC-BYOS-GCE Image SLES15-SP3-Micro-5-2-BYOS-Azure Image SLES15-SP3-Micro-5-2-BYOS-GCE Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAP-BYOS-Azure Image SLES15-SP3-SAP-BYOS-GCE Image SLES15-SP3-SAPCAL-Azure Image SLES15-SP3-SAPCAL-GCE Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:latest Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-Azure Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-SAP-CCloud Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-GCE Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-GCE Image SLES15-SP4-Manager-Proxy-4-3-BYOS Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP4-SAP-BYOS-Azure Image SLES15-SP4-SAP-BYOS-GCE Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAP-Hardened Image SLES15-SP4-SAP-Hardened-Azure Image SLES15-SP4-SAP-Hardened-BYOS-Azure Image SLES15-SP4-SAP-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Hardened-GCE Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-GCE Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/296227 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:01961/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0586/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0587/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0588/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0607/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0629/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:14822/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20511/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20863/ REF https://access.redhat.com/errata/RHSA-2025:16154 REF https://access.redhat.com/security/cve/CVE-2025-1118 REF https://bugzilla.redhat.com/show_bug.cgi?id=2346137 REF https://git.savannah.gnu.org/cgit/grub.git/commit/?id=34824806ac6302f91e8cabaa41308eaced25725f REF https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy