#1144079 Mismerge of CVE-2025-13151

Package:
src:grub2
Source:
src:grub2
Submitter:
Bastien Roucaries
Date:
2026-08-17 17:43:10 UTC
Severity:
normal
Tags:
#1144079#5
Date:
2026-08-10 19:50:59 UTC
From:
To:
CVE-2025-13151 (libtasn1 - off-by-one in asn1_expand_octet_string, fixed in
4.20.0)

The fix changes:
  char name[2 * ASN1_MAX_NAME_SIZE + 1]

 to:
   char name[2 * ASN1_MAX_NAME_SIZE + 2]

This applies to two functions: asn1_expand_any_defined_by and
asn1_expand_octet_string.

Grub2 vendor libtasn1 internally and show a partial fix -
asn1_expand_any_defined_by has been updated (+ 2 present) but
asn1_expand_octet_string still carries the vulnerable version (+ 1):
   - grub2 (grub-core/lib/libtasn1/lib/decoding.c)
        asn1_expand_any_defined_by: patched
     asn1_expand_octet_string: VULNERABLE
     Note: grub2 carries two separate embedded copies (libtasn1 and
 libtasn1-grub)

Thanks to Gajendra Nath Soren

rouca
#1144079#10
Date:
2026-08-11 04:19:06 UTC
From:
To:
Hi,

This embedded copy was added in 9a26abbc368 (grub-2.14-rc1), so it only
(possibly) affects forky/sid.

Cheers,
Charles
#1144079#17
Date:
2026-08-11 08:20:10 UTC
From:
To:
Le mardi 11 août 2026, 06:19:06 heure d’été d’Europe centrale Carlos Henrique Lima Melara a écrit :

Can we report upstream ?

rouca
#1144079#22
Date:
2026-08-11 16:26:45 UTC
From:
To:
Adding the GRUB upstream development list on this too; the information
is already public in the Debian BTS so there's no point trying to keep
thie embargoed.
#1144079#27
Date:
2026-08-11 20:55:06 UTC
From:
To:
Thanks for the heads-up. I created a task on the new GRUB issue tracker.

https://gitlab.freedesktop.org/gnu-grub/grub/-/work_items/66
#1144079#32
Date:
2026-08-11 21:12:19 UTC
From:
To:
+ Thomas Grainger

Thanks Mike for reporting it.

In resume, there is a MR which would solve this
https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/177

Thomas, correct me if I am wrong?