CVE-2025-0690

一、漏洞信息
 漏洞编号：[CVE-2025-0690](https://nvd.nist.gov/vuln/detail/CVE-2025-0690)
 漏洞归属组件：[grub2](https://gitee.com/src-openeuler/grub2)
 漏洞归属的版本：2.04,2.06,2.12
 CVSS V3.0分值：
  BaseScore：6.1 Medium
  Vector：CVSS：3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
 漏洞简述：
  The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to reallocate the line buffer to accept the next character. During this process, with a line big enough it s possible to make this variable to overflow leading to a out-of-bounds write in the heap based buffer. This flaw may be leveraged to corrupt grub s internal critical data and secure boot bypass is not discarded as consequence.
 漏洞公开时间：2025-02-24 16:15:09
 漏洞创建时间：2025-02-19 04:38:39
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-0690
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2025-0690 |  |
| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2346123 |  |
| secalert.redhat.com | https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html |  |
| suse_bugzilla | https://smelt.suse.de/incident/37157/ | https://bugzilla.suse.com/show_bug.cgi?id=1237012 |
| suse_bugzilla | https://smelt.suse.de/incident/37156/ | https://bugzilla.suse.com/show_bug.cgi?id=1237012 |
| suse_bugzilla | https://smelt.suse.de/incident/37155/ | https://bugzilla.suse.com/show_bug.cgi?id=1237012 |
| redhat_bugzilla | https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html | https://bugzilla.redhat.com/show_bug.cgi?id=2346123 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2025-0690 | https://explore.alas.aws.amazon.com/CVE-2025-0690.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0690 | https://explore.alas.aws.amazon.com/CVE-2025-0690.html |
| redhat_bugzilla | https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html | https://bugzilla.redhat.com/show_bug.cgi?id=2346123 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  read命令用于读取用户的键盘输入，而read命令能接受的输入长度保持为32位整数值，该整数值进一步用于重新分配行缓冲区以接受下一个字符。在此过程中，如果输入的内容足够大，则有可能使此变量溢出，从而导致堆内存缓冲区中的越界写入。此漏洞可能被用来破坏grub2的内部关键数据，导致安全启动机制被绕过。
 openEuler评分：
  6.1
 Vector：CVSS：3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(2.12):受影响
2.openEuler-20.03-LTS-SP4(2.04):受影响
3.openEuler-22.03-LTS-SP3(2.06):受影响
4.openEuler-22.03-LTS-SP4(2.06):受影响
5.openEuler-24.03-LTS(2.12):受影响
6.openEuler-24.03-LTS-Next(2.12):受影响
7.openEuler-24.03-LTS-SP1(2.12):受影响

修复是否涉及abi变化(是/否)：
  1.master(2.12):否
2.openEuler-20.03-LTS-SP4(2.04):否
3.openEuler-22.03-LTS-SP3(2.06):否
4.openEuler-22.03-LTS-SP4(2.06):否
5.openEuler-24.03-LTS(2.12):否
6.openEuler-24.03-LTS-Next(2.12):否
7.openEuler-24.03-LTS-SP1(2.12):否

原因说明：
  1.master(2.12):正常修复
2.openEuler-20.03-LTS-SP4(2.04):正常修复
3.openEuler-22.03-LTS-SP3(2.06):正常修复
4.openEuler-22.03-LTS-SP4(2.06):正常修复
5.openEuler-24.03-LTS(2.12):正常修复
6.openEuler-24.03-LTS-Next(2.12):正常修复
7.openEuler-24.03-LTS-SP1(2.12):正常修复

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1292

src-openEuler/grub2

内容风险标识

评论 (5)

src-openEuler/grub2 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-0690

评论 (5)

搜索帮助

src-openEuler/grub2