GRUB2 (network config file search): grub_net_search_config_file copies a network-controlled variable with strcpy

Impact

grub_net_search_config_file copies a network-controlled variable with strcpy into a fixed buffer. This is the highest-priority entry in the 2025 batch for anyone running netboot: an attacker on the provisioning segment corrupts GRUB's memory during PXE and takes the node before the OS exists.

Who can reach it

Anyone who can respond on the network boot path - rogue DHCP server, compromised provisioning host, or a tenant that has been given L2 access to the provisioning VLAN by mistake.

What to do

grub2 package update + reboot, AND rebuild/replace the netboot GRUB binary served over TFTP/HTTP - the served image is the actual attack surface here and patching running nodes does not touch it. Segment the provisioning network away from tenant traffic.

References