CVE-2025-4382

A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlying filesystem superblock, GRUB will fail to locate a valid filesystem and enter rescue mode. At this point, the disk is already decrypted, and the decryption key remains loaded in system memory. This scenario may allow an attacker with physical access to access the unencrypted data without any further authentication, thereby compromising data confidentiality. Furthermore, the ability to force this state through filesystem corruption also presents a data integrity concern.

These are all security issues fixed in the grub2-2.12-50.1 package on the GA media of openSUSE Tumbleweed.

This update for grub2 rebuilds the existing package with the new 4k RSA secure boot key for IBM Power and Z.

Note: the signing key of x86 / x86_64 and aarch64 architectures are unchanged.

Also the following issue were fixed:

• CVE-2025-4382: TPM auto-decryption data exposure (bsc#1242971)
• Fix segmentation fault error in grub2-probe with target=hints_string (bsc#1235971) (bsc#1235958) (bsc#1239651)

This update for grub2 fixes the following issues:

Security fixes:

• CVE-2025-4382: exposure of data from encrypted device through CLI once the root device is successfully unlocked via TPM (bsc#1242971).

Other bug fixes:

• Fix incorrect nvme disks and boot order in bootlist output (bsc#1237174).

This update for grub2 fixes the following issues:

• CVE-2025-4382: Fixed TPM auto-decryption data exposure (bsc#1242971)

• Filter out the non-subvolume btrfs mount points when creating the relative path (bsc#1239674)

• CVE-2024-45781: Fixed ufs strcpy overflow (bsc#1233617)

• CVE-2024-56737: Fixed heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem (bsc#1234958)

• CVE-2024-45782: Fixed hfs strcpy overflow (bsc#1233615)

• CVE-2024-45780: Fixed overflow in tar/cpio(bsc#1233614)

• CVE-2024-45783: Fixed hfsplus refcount overflow (bsc#1233616)

• CVE-2025-0624: Fixed out-of-bounds write in grub_net_search_config_file() (bsc#1236316)

• CVE-2024-45774: Fixed heap overflows in JPEG parser (bsc#1233609)

• CVE-2024-45775: Fixed missing NULL check in extcmd parser (bsc#1233610)

• CVE-2025-0622: Fixed command/gpg: Use-after-free due to hooks not being removed on module unload (bsc#1236317)

• CVE-2024-45776: Fixed overflow in .MO file (gettext) handling (bsc#1233612)

• CVE-2024-45777: Fixed integer overflow in gettext (bsc#1233613)

• CVE-2025-0690: Fixed integer overflow in read that may lead to out-of-bounds write (bsc#1237012)

• CVE-2025-1118: Fixed commands/dump: The dump command is not in lockdown when secure boot is enabled(bsc#1237013)

• CVE-2024-45778: Fixed bfs filesystem not fuzzing stable (bsc#1233606)

• CVE-2024-45779: Fixed bfs heap overflow (bsc#1233608)

• CVE-2025-0677: Fixed integer overflow that may lead to heap based out-of-bounds write when handling symlinks in ufs (bsc#1237002)

• CVE-2025-0684: Fixed reiserfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data (bsc#1237008)

• CVE-2025-0685: Fixed jfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data (bsc#1237009)

• CVE-2025-0686: Fixed romfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data (bsc#1237010)

• CVE-2025-0689: Fixed udf: Heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution (bsc#1237011)

• CVE-2025-1125: Fixed fs/hfs: Interger overflow may lead to heap based out-of-bounds write (bsc#1237014)

• CVE-2025-0678: Fixed squash4: Integer overflow may lead to heap based out-of-bounds write when reading data (bsc#1237006)

• Bump upstream SBAT generation to 5 to block older grub2 versions.

• CVE-2024-49504: Fixed Bypassing TPM-bound disk encryption on SL(E)M encrypted Images (bsc#1229163) (bsc#1229164)

• Restrict CLI access if the encrypted root device is automatically unlocked by the TPM. LUKS password authentication is required for access to be granted

• Obsolete, as CLI access is now locked and granted access no longer requires the previous restrictions

This update for grub2 fixes the following issues:

• Fix error: /boot/grub2/x86_64-efi/bli.mod not found (bsc#1231591)

• Fix OOM error in loading loopback file (bsc#1230840) (bsc#1249140)

• Update the patch to fix "SRK not matched" errors when unsealing the key (bsc#1232411) (bsc#1247242)

Security fixes for 2024:

• Bump upstream SBAT generation to 5

• CVE-2024-45774: Fixed heap overflows in JPEG parser (bsc#1233609)

• CVE-2024-45775: Fixed missing NULL check in extcmd parser (bsc#1233610)

• CVE-2024-45776: Fixed overflow in .MO file (gettext) handling (bsc#1233612)

• CVE-2024-45777: Fixed integer overflow in gettext (bsc#1233613)

• CVE-2024-45778: Fixed bfs filesystem not fuzzing stable (bsc#1233606)

• CVE-2024-45779: Fixed bfs heap overflow (bsc#1233608)

• CVE-2024-45780: Fixed overflow in tar/cpio (bsc#1233614)

• CVE-2024-45781: Fixed ufs strcpy overflow(bsc#1233617)

• CVE-2024-45782: Fixed hfs strcpy overflow (bsc#1233615)

• CVE-2024-45783: Fixed hfsplus refcount overflow (bsc#1233616)

• CVE-2024-49504: Fixed bypassing TPM-bound disk encryption on SL(E)M encrypted Images (bsc#1229163) (bsc#1229164)

• CVE-2024-56737: Fixed heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem (bsc#1234958)

• CVE-2024-56738: Fixed side-channel attack due to not constant-time algorithm in grub_crypto_memcmp (bsc#1234959)

• CVE-2025-0622: Fixed command/gpg use-after-free due to hooks not being removed on module unload (bsc#1236317)

• CVE-2025-0624: Fixed net Out-of-bounds write in grub_net_search_config_file() (bsc#1236316)

• CVE-2025-0677: Fixed UFS integer overflow may lead to heap based out-of-bounds write when handling symlinks (bsc#1237002)

• CVE-2025-0678: Fixed squash4 Integer overflow may lead to heap based out-of-bounds write when reading data (bsc#1237006)

• CVE-2025-0684: Fixed reiserfs Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data (bsc#1237008)

• CVE-2025-0685: Fixed jfs Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data (bsc#1237009)

• CVE-2025-0686: Fixed romfs Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data (bsc#1237010)

• CVE-2025-0689: Fixed udf heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution (bsc#1237011)

• CVE-2025-0690: Fixed "read" integer overflow may lead to out-of-bounds write (bsc#1237012)

• CVE-2025-1118: Fixed commands/dump The dump command is not in lockdown when secure boot is enabled (bsc#1237013)

• CVE-2025-1125: Fixed fs/hfs interger overflow may lead to heap based out-of-bounds write (bsc#1237014)

• CVE-2025-4382: Fixed TPM auto-decryption data exposure (bsc#1242971)

• Restrict CLI access if the encrypted root device is automatically unlocked by the TPM. LUKS password authentication is required for access to be granted