The GRUB bootloader is a component used to manage the boot process in Linux systems. It reads configuration files and loads operating system kernels. This vulnerability occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values.
You're affected if you use GRUB 2.06-3 or earlier versions. To check if your system is vulnerable, run lsusb -v -d 1:1f and look for the "Boot" entry in the device tree. If you don't see a Boot entry, you are likely not affected.
Note: This vulnerability does not affect GRUB 2.07 or later versions, which have been patched.
To fix this vulnerability, update your system to a supported version of GRUB. For Debian-based systems, run sudo apt-get update && sudo apt-get install grub-efi-amd64-minimal. For Fedora-based systems, run sudo dnf install grub2-efi-amd64.
Immediate mitigations:
- If you can't upgrade immediately, remove the boot option from your GRUB configuration file (/boot/grub/grub.cfg) to prevent the bootloader from loading maliciously configured USB devices.