CVE-2024-2312

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-04-05 · updated 2026-06-17
Weakness: CWE-416

Description

GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.

Affected products

grub2: before 2.12-1ubuntu5 — fixed in 2.12-1ubuntu5
NetApp Bootstrap Os: all versions

How to fix

Upgrade to a fixed version: grub2 2.12-1ubuntu5. Check the vendor advisory for mitigations.

References

https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2312
https://security.netapp.com/advisory/ntap-20240426-0003/
https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2312
https://security.netapp.com/advisory/ntap-20240426-0003/

Get alerted when CVE-2024-2312 or the next vulnerability affects your stack