GRUB2 (grub_malloc allocator): GRUB's allocator never checks the requested size for arithmetic overflow, so a tenant

Impact

GRUB's allocator never checks the requested size for arithmetic overflow, so a tenant who can influence any parsed structure gets a heap that is smaller than GRUB believes it is. The payoff is arbitrary write inside the bootloader, which means loading an unsigned kernel with Secure Boot still reporting green. On a bare-metal GPU node that is the difference between 'the next tenant gets a clean box' and 'the next tenant gets the last tenant's rootkit'.

Who can reach it

A tenant with root on a node they rented, or anyone who can write the EFI System Partition (including via BMC virtual media). Not remote on its own - it is the persistence half of a two-stage attack.

What to do

grub2 package update plus reboot on every node. The package update alone does not close it: the old signed GRUB binary stays trusted until the UEFI revocation list (dbx) is updated, and pushing dbx before every node is on the new shim/GRUB will brick nodes at next boot. Plan it as two passes with a verification gate between them.

References

Related entries

• GRUB2 (squashfs symlink parser): Integer overflow in grub_squash_read_symlink lets a crafted squashfs image driveCVE-2020-14309 · GRUB2 (squashfs symlink parser)Medium
• GRUB2 (read_section_from_string): Integer overflow while reading a section string overflows the heap and gives controlCVE-2020-14310 · GRUB2 (read_section_from_string)Medium
• GRUB2 (ext2/ext4 symlink reader): Integer overflow in grub_ext2_read_link on a crafted ext filesystem yields a heapCVE-2020-14311 · GRUB2 (ext2/ext4 symlink reader)Medium
• GRUB2 (script function redefinition): Use-after-free when a GRUB script redefines a function while that functionCVE-2020-15706 · GRUB2 (script function redefinition)Medium
• GRUB2 (grub-install shim_lock regression): GRUB 2.06~rc1 reintroduced the earlier direct-boot flaw: grub-install couldCVE-2021-3418 · GRUB2 (grub-install shim_lock regression)Medium
• Insyde InsydeH2O (IhisiSmm parameter buffer, DMA TOCTOU): IHISI is Insyde's own firmware-services interfaceCVE-2022-30773 · Insyde InsydeH2O (IhisiSmm parameter buffer, DMA TOCTOU)Medium