GRUB2 (dump command lockdown): The dump command was not disabled under Secure Boot lockdown, letting a privileged user

Impact

The dump command was not disabled under Secure Boot lockdown, letting a privileged user read arbitrary memory at boot. That includes anything the firmware left in RAM - most usefully, key material and Secure Boot state. Low CVSS, high value as a reconnaissance primitive before a real bypass.

Who can reach it

Local privileged user at the GRUB shell.

What to do

grub2 package update + reboot. A GRUB password limits access to the shell in the meantime, but does not fix the lockdown gap.

References