GRUB gettext Module Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the gettext module of GRUB. This issue arises because the gettext command remains registered in memory even after the module is unloaded. An attacker can exploit this flaw by invoking the lingering command, which leads the application to access an invalid memory location. This exploitation can cause GRUB to crash, resulting in a denial-of-service condition. Additionally, there is a potential risk of compromising data integrity or confidentiality.

Impact

Exploitation of this vulnerability can cause GRUB to crash, leading to a denial-of-service condition. However, there is also a potential risk of compromising data integrity or confidentiality.

Remediation

The vulnerability has been fixed by adding an unregister call for the gettext command when the module is unloaded. Users should upgrade to a version of GRUB that includes this fix.