CVE-2025-0622 Grub2: command/gpg: use-after-free due to hooks not being removed on module unload
Attackers can exploit a use-after-free in GRUB2 to execute arbitrary code and bypass Secure Boot protections.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-0622?
CVE-2025-0622 is a medium-severity use after free vulnerability in Red Hat Enterprise Linux 10, published on 18 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw allows an attacker to force grub2 to call the hooks once the module that registered it was unloaded, leading to a use-after-free vulnerability. If correctly exploited, this vulnerability may result in arbitrary code execution, eventually allowing the attacker to bypass secure boot protections.
Weakness: CWE-416
Which versions are affected by CVE-2025-0622?
How do I fix CVE-2025-0622?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-0622 being exploited?
There is no known exploitation of CVE-2025-0622 in the wild and no public exploit code.
Sources
Also known as AZL-110406, BELL-CVE-2025-0622, DEBIAN-CVE-2025-0622, GHSA-vjmw-pmxv-8c6w, UBUNTU-CVE-2025-0622.