Description
A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | grub2 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | grub2 +18 | 1:2.02-78.el8_1.1 | RHSA-2020:0335 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | grub2 +17 | 1:2.06-2.amzn2.0.1 | ALAS2-2021-1684 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | grub2-pc +15 | 1:2.02-78.0.2.el8 | ELSA-2020-0335, ELSA-2019-4869 |
Advisories 5
- RHSA-2020:0335 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- WID-SEC-2024-0659 Grub: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Mar 18, 2024
- ALAS2-2021-1684 Moderate: grub2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 29, 2024
- ELSA-2020-0335 Moderate: grub2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 7, 2020
- ELSA-2019-4869 Important: grub2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Dec 17, 2019