Grub2: command/gpg: use-after-free due to hooks not being removed on module unload

A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw allows an attacker to force grub2 to call the hooks once the module that registered it was unloaded, leading to a use-after-free vulnerability. If correctly exploited, this vulnerability may result in arbitrary code execution, eventually allowing the attacker to bypass secure boot protections.

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

释放后使用

GNU GRUB 资源管理错误漏洞

GNU GRUB是GNU社区的一款Linux系统引导程序。 GNU GRUB存在资源管理错误漏洞，该漏洞源于模块卸载后未清除钩子，会导致释放后重用并执行任意代码。

N/A

N/A