GRUB2 (net/ip IPv4 reassembly): Integer underflow in grub_net_recv_ip4_packets from a crafted IP packet

Impact

Integer underflow in grub_net_recv_ip4_packets from a crafted IP packet. This one matters far more than the filesystem bugs for a GPU cloud, because it is reachable over the network during PXE boot - an attacker who can answer on the provisioning VLAN owns the node before any OS, tenant, or agent exists.

Who can reach it

Anyone who can put packets on the provisioning/PXE network while a node is netbooting. No credentials, no prior access to the node.

What to do

grub2 package update + reboot, and update the netboot GRUB image you actually serve - patching running nodes does nothing if the TFTP/HTTP-served binary is stale. Compensating control: put provisioning on an isolated L2 segment with DHCP snooping, and do not let tenant workloads share it.

References