NIXPKGS-2026-0004
GitHub issue
published on 30 Jan 2026
by @fricklerhandwerk Activity log
- Created automatic suggestion
- @fricklerhandwerk removed package grub2_pvhgrub_image
- @fricklerhandwerk accepted
- @fricklerhandwerk published on GitHub
Grub2: fs/ufs: oob write in the heap
A flaw was found in grub2. When reading a symbolic link's name from a UFS filesystem, grub2 fails to validate the string length taken as an input. The lack of validation may lead to a heap out-of-bounds write, causing data integrity issues and eventually allowing an attacker to circumvent secure boot protections.
Affected products
grub2
- =<2.12
- *
rhcos
Package maintainers
-
@hehongbo Hongbo
-
@CertainLach Yaroslav Bolyukin <iam@lach.pw>
-
@SigmaSquadron Fernando Rodrigues <alpha@sigmasquadron.net>