Description
A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in grub.cfg. This flaw affects grub2 2.06 and previous versions. This issue has been fixed in grub upstream but no version with the fix is currently released.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | grub2 | grub2 2.06 and previous versions | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | grub2 | 2.06-8 | — |
| Debian 13 | grub2 | 2.06-8 | — |
| Debian 12 | grub2 | 2.06-8 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | grub2-signed | 1.187.3~22.04.1 | USN-6355-1 |
| Ubuntu 22.04 LTS | grub2-unsigned | 2.06-2ubuntu14.1 | USN-6355-1 |
| Ubuntu 22.04 LTS | shim | 15.7-0ubuntu1 | USN-6355-1 |
| Ubuntu 22.04 LTS | shim-signed | 1.51.3 | USN-6355-1 |
| Ubuntu 20.04 LTS | grub2-signed | 1.187.3~20.04.1 | USN-6355-1 |
| Ubuntu 20.04 LTS | grub2-unsigned | 2.06-2ubuntu14.1 | USN-6355-1 |
| Ubuntu 20.04 LTS | shim | 15.7-0ubuntu1 | USN-6355-1 |
| Ubuntu 20.04 LTS | shim-signed | 1.40.9 | USN-6355-1 |
| Ubuntu 18.04 LTS | grub2-signed +1 | No fix yet | — |
| Ubuntu 16.04 LTS | grub2-signed +1 | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | grub2-signed | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | grub2 +18 | 1:2.02-123.el8 | RHSA-2022:2110 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | grub2-pc +16 | 1:2.02-123.el8.alma | ALSA-2022:2110 |
| AlmaLinux 8 | grub2-ppc64le | 1:2.02-123.el8_6.8.alma | ALSA-2022:2110 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | grub2 | 1:2.02-123.el8 | RLSA-2022:2110 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grub2 | 2.06-13.1 | openSUSE-SU-2024:11700-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | grub2-pc +16 | 1:2.06-61.amzn2023.0.3 | ALAS2023-2023-020 |
| Amazon Linux 2 | grub2 +17 | 1:2.06-9.amzn2.0.1 | ALAS2-2022-1787 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | grub2 | 2.06-14 | — |
| Azure Linux 2 (CBL-Mariner) | grub2 | 2.06-5 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | grub2-pc +15 | 1:2.02-123.0.1.el8 | ELSA-2022-2110 |
Advisories 9
- ALSA-2022:2110 Low: grub2 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:2110 Red Hat Security Advisory: grub2 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 21, 2026
- USN-6355-1 grub2-signed, grub2-unsigned, shim, and shim-signed vulnerability Ubuntu Security Notices (USN) · May 29, 2026
- RLSA-2022:2110 Low: grub2 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2024:11700-1 grub2-2.06-13.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0452 Grub2: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Sep 7, 2023
- ALAS2023-2023-020 Important: grub2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- ELSA-2022-2110 Low: grub2 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 17, 2022
- ALAS2-2022-1787 Low: grub2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 27, 2022