net: Out-of-bounds write in grub_net_search_config_file()
CVE: CVE-2025-0624
Component: grub2
CWE: CWE-787
Severity: Important
CVSS v3: 7.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2025-02-18T18:00:00+00:00

A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to by-pass secure boot protections.

Statement: Red Hat Product Security team has rated this vulnerability as Important, as an attacker that has access to the same network segment is able to exploit it once netboot is enabled in grub2.

Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

     https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:24c2ea09853e520e47bdd03e5fc9b865f0a8bac7a38aad458e9785fe0f7546ac

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

     https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes

You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:9d16c0afca73d20e79bc190e318a305f466a571fab05766dae6b597957ec0ebf

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You can download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:66bd4e160209b4e7add5514498c4889812b76fa2786d1219d7d2152eea1b4f1c

(For s390x architecture)
The image digest is sha256:9a56729c25596d90c228f04d5e4b5080a3921a325e0c768da51b81b6a032cf07

(For ppc64le architecture)
The image digest is sha256:078d5b2c3ce7ed409c454c01113e6171a8852f434069c1f8565e4a310b8e00b5

(For aarch64 architecture)
The image digest is sha256:b1e60833e9535efa25a4e42efe461e6c0c9b7fcea4a499428bdee7577884f0cf

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:f0421eafd1ab27c694f6bfc6ec8a8641636030485a3a4c80071ce7fa1a1bf04c

      (For s390x architecture)
      The image digest is sha256:49188f681f854dda12f1c3e72b5066d957f5903705ca6d060bb54399838272e3

      (For ppc64le architecture)
      The image digest is sha256:4e464e5377d636c2f14838b0965af486949b410a31be742b7ca2e5116954d304

      (For aarch64 architecture)
      The image digest is sha256:06f68ebf40881e9c7e29b94883a840e1119ed104e33676d2c15f5ad066339306

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:6da09834a9e0e30a79f77c13c2520a25172d8be3fc044dc2ad1392d69b2edfbf

      (For s390x architecture)
      The image digest is sha256:bcd96f1db1a6dcf6f7185d5410d9d665fb72545b1094c5d4e5696e08c10e0adf

      (For ppc64le architecture)
      The image digest is sha256:30f50074efde956337703e02c05a8a47854a669745178684ab9e18ca38173278

      (For aarch64 architecture)
      The image digest is sha256:0b83c98681f690f8c45c0f13002c251b925023da9416bf3106f9e9aeeec810ef

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:7e8b4557c0a15765440c543ab50cd591bb94f0745c20564e5f15d57bf5f76a82

      (For s390x architecture)
      The image digest is sha256:dd3148c37d8b4122f500ae1bb92e29e34d1cc3bfa634d5c53a9f8528945abd2d

      (For ppc64le architecture)
      The image digest is sha256:04bf2f5c15417eeb7de26d95de767b62ce263d5cc99400cbaa4d370c5007ab18

      (For aarch64 architecture)
      The image digest is sha256:b491dcca8f5a2fe177f628f661a23086497440cf9b994638b199b9299335741b

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:509888097ba7d3b4eeb5aac0586acff2ec13fff07004ac692e0dcf5cf4fe2690

      (For s390x architecture)
      The image digest is sha256:7af6036c5d10145fa4d4138aeeb07ac812f658b100913cf8722f365973566b1e

      (For ppc64le architecture)
      The image digest is sha256:c36276a6a0473f03319fb57179538a41ca9e75c1c30d0a5e5a277a082135d6e9

      (For aarch64 architecture)
      The image digest is sha256:b9dd5873644fcab301178105df2b45e29d885da98b373a215329b610efb6c6ec

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.