dbcve.org
Grub2Application · Gnu

CVE-2025-1125

HIGH · 7.8 CVSS v3.1 Published 2025-03-03
Fix available
A fix is available. Upgrade to after 2.12 or later.
See remediation →
81/100
Remediation priority · High
No privileges

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal buffers size, however it misses to properly check for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculation to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result the hfsplus_open_compressed_real() function will write past of the internal buffer length. This flaw may be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution by-passing secure boot protections.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Integer overflow vulnerability in GRUB's HFS+ filesystem module where metadata-derived buffer size calculations lack overflow validation. A maliciously crafted HFS+ filesystem causes grub_malloc() to allocate undersized buffers, resulting in heap buffer overflow in hfsplus_open_compressed_real() that corrupts internal memory and can enable arbitrary code execution, bypassing Secure Boot protections.

MitigationUpdate GRUB to a patched version containing integer overflow checks in the hfs filesystem module. Verify integrity of the boot chain and ensure Secure Boot is properly enforced. For systems mounting HFS+ filesystems at boot, apply updates immediately.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Grub2Application
Affected:<= 2.12

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify GRUB version
    Run 'grub-install --version' or check the package manager (e.g., 'dpkg -l grub-*' on Debian/Ubuntu, 'rpm -qa | grep grub' on RHEL/CentOS)
    Affected if Version is 2.12 or lower
  2. Locate HFS+ filesystem module
    Search for the hfsplus module in the GRUB modules directory (typically /usr/lib/grub/*/hfsplus.mod or /boot/grub/*/hfsplus.mod)
    Affected if The hfsplus.mod module file exists in the GRUB installation
  3. Check boot configuration for HFS+ usage
    Inspect GRUB config files (/boot/grub/grub.cfg, /etc/default/grub) and bootloader config for references to 'hfsplus' or 'set root=' pointing to HFS+ partitions. Also check /etc/fstab for mounted HFS+ filesystems.
    Affected if GRUB configuration loads or references HFS+ filesystems at boot time (the vulnerable code path hfsplus_open_compressed_real() is triggered when opening a compressed HFS+ file)
  4. Identify boot partitions using HFS+
    Use 'blkid' or 'file -s /dev/sd*' to list partition filesystems. If any partition used by GRUB for /boot or as the boot partition is HFS+, the vulnerable code path can be reached.
    Affected if Boot loader or boot partition uses HFS+ filesystem

Environment is affected if GRUB version is 2.12 or lower AND the HFS+ module is present and the system boots from or loads an HFS+ filesystem, enabling the vulnerable hfsplus_open_compressed_real() code path.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 2.12
Interim mitigation

Update GRUB to a patched version containing integer overflow checks in the hfs filesystem module. Verify integrity of the boot chain and ensure Secure Boot is properly enforced. For systems mounting HFS+ filesystems at boot, apply updates immediately.

Recommended fix Moderate confidence

Grub2 version > 2.12 (e.g., 2.12-1 or later, exact version depends on distribution)

  1. Verify the current Grub2 version installed on the system using: grub2-install --version or rpm -q grub2*
  2. Obtain the patched Grub2 version from the distribution's official security repository (Red Hat, or downstream distributions like CentOS, Fedora)
  3. Ensure secure boot is disabled or in setup mode before modifying Grub2
  4. Download or update the Grub2 package to a version newer than 2.12 that includes the CVE-2025-1125 fix
  5. Back up the current Grub2 installation and configuration (typically /boot/grub2/ or /boot/efi/EFI/*/grubx64.efi)
  6. Install the updated Grub2 package using the distribution's package manager (e.g., dnf update grub2* or yum update grub2*)
  7. Reinstall Grub2 to the boot disk/EFI partition if necessary: grub2-install /dev/sdX for BIOS or grub2-install --target=x86_64-efi for UEFI
  8. Regenerate Grub configuration: grub2-mkconfig -o /boot/grub2/grub.cfg (BIOS) or grub2-mkconfig -o /boot/efi/EFI/*/grub.cfg (UEFI)
Caveat Upgrading Grub2 carries risk of boot failure if misconfigured; test in a safe environment first; Secure Boot requires signed binaries from trusted vendors

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Grub2 Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-1125 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-1125 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data