GRUB2 (initrd size handling): Integer overflows in the initrd command's size arithmetic corrupt GRUB's heap

Impact

Integer overflows in the initrd command's size arithmetic corrupt GRUB's heap. Same end state as the rest of the family - unsigned code running pre-kernel with Secure Boot still claiming to be enforcing.

Who can reach it

Requires the attacker to control the initrd list, i.e. write access to boot configuration on the node.

What to do

grub2 package update + reboot. No config-only mitigation.

References