Database/Firmware, BMC & network fabric
GRUB2: Buffer overflow in `grub.cfg` parsing allowing Secure Boot bypass and arbitrary code execution inside GRUB
Impact
Buffer overflow in grub.cfg parsing allowing Secure Boot bypass and arbitrary code execution inside GRUB — a bootkit that persists across OS reinstall
Who can reach it
Local, or via a modified PXE-boot network
What to do
dbx (Secure Boot revocation list) push plus a coordinated GRUB/shim/kernel update. The dbx push is the dangerous part: revoking the old shim before every node has the new bootloader leaves the node unbootable, and recovery is out-of-band console work per node
Fleet impact
How widespread
universal - GRUB2 + the Microsoft-signed shim is the boot path for nearly every Linux GPU node
Cost to remediate
node-reboot + firmware-flash-class pain: patching GRUB is easy, but the real fix is a **dbx revocation** update pushed into UEFI NVRAM on every node, and a botched dbx push makes the node unbootable - which is why operators delay it for years
Why it hits the whole fleet
A config-file buffer overflow in GRUB2 lets attackers run pre-OS bootkits with Secure Boot enabled; because every old signed GRUB stays valid until revoked, the fleet remains exploitable until each node's firmware revocation list is updated.
References
Related entries
- GRUB2 (direct kernel boot without shim): When GRUB is booted directly by UEFI rather than chained through shim, it doesCVE-2020-15705 · GRUB2 (direct kernel boot without shim)High
- Cisco NX-OS (BGP MD5 authentication): BGP MD5 authentication can be bypassed, so an attacker can bring up a BGP sessionCVE-2020-3165 · Cisco NX-OS (BGP MD5 authentication)High
- Dell client and server BIOS - NVMe drive password (SED credential) defeated by resetting the BIOS passwordCVE-2021-21522 · Dell client and server BIOS - NVMe drive password (SED credential) defeated by resetting the BIOS password via the…High
- Insyde InsydeH2O (FwBlockServiceSmm): Software SMI services reachable through EFI_SMM_COMMUNICATION_PROTOCOL neverCVE-2021-33627 · Insyde InsydeH2O (FwBlockServiceSmm)High
- InsydeH2O: HDD password is stored in plaintext in a UEFI variable readable from the OSCVE-2021-38489 · InsydeH2O UEFI firmware (HDD password stored in a UEFI variable)High
- GRUB2 (shim_lock verifier): The shim_lock verifier let non-kernel files through, so an attacker could get unsignedCVE-2022-28735 · GRUB2 (shim_lock verifier)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.