CVE-2024-2312

mediumpriority · track · 0EPSS 0.004 · 32 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.38% (32nd) EPSS

CVSS 6.7 · medium

Is it mine?

14 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedshim-0:16.1-1.1.aarch64 as component of SUSE Linux Micro 6.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-1.1.x86_64 as component of SUSE Linux Micro 6.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-160000.1.1.aarch64 as component of SUSE Linux Micro 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-160000.1.1.x86_64 as component of SUSE Linux Micro 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.aarch64 as component of SUSE Linux Enterprise Micro 5.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.aarch64 as component of SUSE Linux Enterprise Micro 5.3suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.aarch64 as component of SUSE Linux Enterprise Micro 5.4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.aarch64 as component of SUSE Linux Enterprise Micro 5.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.aarch64 as component of SUSE Linux Enterprise Server 15 SP4-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.aarch64 as component of SUSE Linux Enterprise Server 15 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.aarch64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.x86_64 as component of SUSE Linux Enterprise Micro 5.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.x86_64 as component of SUSE Linux Enterprise Micro 5.3suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.x86_64 as component of SUSE Linux Enterprise Micro 5.4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.x86_64 as component of SUSE Linux Enterprise Micro 5.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.x86_64 as component of SUSE Linux Enterprise Server 15 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-150300.4.31.3.x86_64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-160000.1.1.aarch64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedshim-0:16.1-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technical severity, 0–10. One row per scoring source.

6.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.7mediumAV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · security@ubuntu.comexploitability 0.8 · impact 5.9

v3.16.1mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · SUSE Product Security

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-416USCWE-416US

affected products (14)

Products and version ranges known to be affected.

Dell Secure Connect Gateway <5.36.00.16all versionscert_bundDE
Open Source Grub 2all versionscert_bundDEcpe:/a:gnu:grub:2
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Dell Secure Connect Gateway< 5.36.00.16cert_bundDE
Debian Debian based GNU GRUBall versionsenisa_euvdEU
Debian Debian based GNU GRUB0 → 2.12-1ubuntu5enisa_euvdEU
Erich Boleyn Grub2≤ 2.12 rc1-10ubuntu4.2fstec_bduRU
АО «НППКТ» ОСОН ОСнова 3 Оnyx≤ 3.2fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.12fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.15fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 3.8fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.8fstec_bduRU
gnu grub2< 2.12-1ubuntu5nvdUScpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*
netapp bootstrap osall versionsnvdUScpe:2.3:o:netapp:bootstrap_os:*:*:*:*:*:*:*:*

advisories (6)

Vendor and ecosystem advisories describing this.

SUSE-RU-2026:20004-1Recommended update for shim2025-12-30csaf · suse_csafDE
Recommended update for shim
SUSE-RU-2026:20056-1Recommended update for shim2026-01-01csaf · suse_csafDE
Recommended update for shim
SUSE-RU-2026:20683-1Recommended update for shim2026-03-05csaf · suse_csafDE
Recommended update for shim
SUSE-SU-2026:0741-1Security update for shim2026-03-02csaf · suse_csafDE
Security update for shim
WID-SEC-W-2024-0805Grub2: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2024-04-07csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in Grub2 ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
openSUSE-RU-2026:20325-1Recommended update for shim2026-03-05csaf · suse_csafDE
Recommended update for shim

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd suse_csaf NVD CVE.org MITRE

published 2024-04-05modified 2026-09-23

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan