CVE-2024-2312

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-2312
GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.

6.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127 Exploit Issue Tracking Patch
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2312 Third Party Advisory
https://security.netapp.com/advisory/ntap-20240426-0003/ Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127 Exploit Issue Tracking Patch
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2312 Third Party Advisory
https://security.netapp.com/advisory/ntap-20240426-0003/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
History

26 Aug 2025, 17:17

Type Values Removed Values Added
CPE cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*
References () https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127 - () https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127 - Exploit, Issue Tracking, Patch
References () https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2312 - () https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2312 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20240426-0003/ - () https://security.netapp.com/advisory/ntap-20240426-0003/ - Third Party Advisory
First Time Gnu
Netapp hci Compute Node
Netapp
Netapp bootstrap Os
Gnu grub2

21 Nov 2024, 09:09

Type Values Removed Values Added
References () https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127 - () https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127 -
References () https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2312 - () https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2312 -
References () https://security.netapp.com/advisory/ntap-20240426-0003/ - () https://security.netapp.com/advisory/ntap-20240426-0003/ -

29 Aug 2024, 20:36

Type Values Removed Values Added
CWE CWE-416

26 Apr 2024, 09:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240426-0003/ -

08 Apr 2024, 18:49

Type Values Removed Values Added
Summary
  • (es) GRUB2 no llama a las funciones fini del módulo al salir, lo que hace que el módulo peimage GRUB2 de Debian/Ubuntu deje los ganchos de la tabla del sistema UEFI después de la salida. Esto conduce a una condición de use-after-free y posiblemente podría conducir a una omisión de arranque segura.

05 Apr 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-05 20:15

Updated : 2025-08-26 17:17

NVD link : CVE-2024-2312

Mitre link : CVE-2024-2312

CVE.ORG link : CVE-2024-2312

JSON object : View

Products Affected

gnu

  • grub2

netapp

  • bootstrap_os
  • hci_compute_node
CWE
CWE-416

Use After Free