CVE-2024-49504: grub2 Information Disclosure Vulnerability

CVE-2024-49504 Overview

CVE-2024-49504 affects the GRand Unified Bootloader version 2 (GRUB2). The vulnerability allows attackers with access to the grub shell to read files on encrypted disks. This bypasses the confidentiality protections that disk encryption is intended to provide. The flaw is categorized under [CWE-276] Incorrect Default Permissions. Exploitation requires physical or local access to the bootloader interface, limiting remote risk. However, the impact on data confidentiality, integrity, and availability is high once the attacker reaches the grub shell.

Critical Impact
Attackers with grub shell access can read sensitive files from encrypted volumes, defeating full-disk encryption guarantees.

Affected Products

GNU GRUB2 bootloader
Linux distributions shipping the affected GRUB2 builds, including SUSE
Systems relying on GRUB2 to unlock LUKS-encrypted volumes

Discovery Timeline

2024-11-13 - CVE-2024-49504 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-49504

Vulnerability Analysis

GRUB2 mounts and reads encrypted partitions after the user supplies the correct passphrase or keyfile during boot. Once a disk is unlocked, GRUB2 retains access to the decrypted content. The grub shell, an interactive command interpreter exposed by the bootloader, can then enumerate and read files on these volumes. The defect lies in how GRUB2 enforces access controls on already-decrypted disks within the shell context. An attacker who reaches the shell, whether through misconfiguration, missing password protection, or boot interruption, can read protected files without re-authenticating.

Root Cause

The vulnerability is rooted in incorrect default permissions on file access from the grub shell. GRUB2 does not separately gate shell-level file reads from encrypted volumes, treating them like any other accessible filesystem after unlock. The expected behavior is to restrict or re-authenticate access when shell commands target encrypted media. The actual behavior allows direct reads through standard grub commands such as cat or ls.

Attack Vector

The attack requires physical or console access to the boot interface, consistent with the CVSS Physical (AV:P) vector. An attacker interrupts the boot process to reach the grub shell, or leverages a system where the shell is reachable without password protection. From the shell, the attacker enumerates partitions with ls and reads files using cat (hdX,Y)/path/to/file. If the encrypted volume was previously unlocked in the same boot session, or the attacker supplies a known passphrase, the contents are returned in cleartext. No remote network access, user interaction, or elevated privileges beyond shell access are required.

Detection Methods for CVE-2024-49504

Indicators of Compromise

Unexpected boot interruptions or extended pre-OS dwell times recorded in firmware or platform logs
Modifications to /etc/default/grub or /etc/grub.d/ files removing password protection (password_pbkdf2)
Console access events on servers outside scheduled maintenance windows
Missing or altered grub.cfg entries that would normally enforce set superusers and authenticated menu entries

Detection Strategies

Audit GRUB configuration files for the presence of set superusers and password_pbkdf2 directives protecting the shell and edit functions
Monitor file integrity on /boot/grub2/grub.cfg, /etc/default/grub, and related configuration paths
Correlate physical access logs, KVM/iLO/iDRAC session records, and out-of-band management activity with unscheduled reboots

Monitoring Recommendations

Enable and forward BMC, iLO, and iDRAC console session logs to a centralized log store for review
Track package updates to grub2, grub2-common, and distribution-specific GRUB packages to confirm patched versions are deployed
Alert on systems that boot without producing expected post-boot telemetry within defined windows, which may indicate prolonged shell interaction

How to Mitigate CVE-2024-49504

Immediate Actions Required

Apply vendor-supplied GRUB2 updates as soon as distribution patches become available, tracked through advisories such as the SUSE Bug Report CVE-2024-49504
Configure GRUB password protection to require authentication before reaching the shell or editing menu entries
Restrict physical and remote console access to authorized administrators only
Enable Secure Boot and verify that boot chain integrity measurements are validated by the platform

Patch Information

Distribution vendors are coordinating fixes through their respective security trackers. Refer to the SUSE Bug Report CVE-2024-49504 for status updates on affected packages and to other distribution advisories for Debian, Red Hat, Ubuntu, and upstream GNU GRUB releases. Validate patched package versions after installation and rebuild grub.cfg where required.

Workarounds

Set a GRUB superuser and PBKDF2-hashed password using grub2-mkpasswd-pbkdf2 and update /etc/grub.d/40_custom to require authentication for shell and edit operations
Disable the grub command line entirely on systems that do not require it by using GRUB_DISABLE_RECOVERY=true and removing rescue entries
Use chassis intrusion detection and locked server cabinets to reduce the risk of physical access to the boot console
Where supported, configure TPM-bound LUKS unlocking with PCR policies that fail if the boot chain is tampered with

bash

# Configuration example: enforce GRUB superuser authentication
grub2-mkpasswd-pbkdf2
# Add to /etc/grub.d/40_custom:
set superusers="admin"
password_pbkdf2 admin grub.pbkdf2.sha512.10000.<HASH>
# Regenerate grub configuration:
grub2-mkconfig -o /boot/grub2/grub.cfg