CVE-2025-1118
Grub2: commands/dump: the dump command is not in lockdown when secure boot is enabled
CVSS Score
4.4
EPSS Score
0.0%
EPSS Percentile
14th
A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory.
| CWE | CWE-501 |
| Published | Feb 19, 2025 |
| Last Updated | Mar 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for
Be the first to know when new medium vulnerabilities are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Red Hat / Red Hat Enterprise Linux 10
All versions affected Red Hat / Red Hat Enterprise Linux 7
All versions affected Red Hat / Red Hat Enterprise Linux 8
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat OpenShift Container Platform 4
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2025:16154 access.redhat.com: https://access.redhat.com/security/cve/CVE-2025-1118 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2346137 git.savannah.gnu.org: https://git.savannah.gnu.org/cgit/grub.git/commit/?id=34824806ac6302f91e8cabaa41308eaced25725f lists.gnu.org: https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html