BootHole Blows Hole In GRUB2 Bootloader Security, Including UEFI SecureBoot

A major vulnerability in the GRUB2 boot-loader has been made public today that compromises its UEFI SecureBoot capabilities.

This vulnerability dubbed "BootHole" can allow for malicious code to be inserted into the system at early boot time via GRUB and can even be exploited on UEFI SecureBoot enabled systems.

Poor parsing within GRUB's configuration file parser could lead to a buffer overflow within GRUB2 that in turn could be used for executing malicious commands. BootHole can allow for bootkits to be installed onto the system among other nefarious efforts.

All major Linux distributions and any other users of the GRUB2 boot-loader will need to be patched.

More details on BootHole via Eclypsium who discovered this vulnerability.