CVE-2020-25632: 
Rocky Linux vulnerability analysis and mitigation

A flaw was discovered in grub2 versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded, leading to a use-after-free scenario. This vulnerability is tracked as CVE-2020-25632 and was discovered by Chris Coulson (Ubuntu Security).

The vulnerability is classified with a CVSS v3.1 Base Score of 8.2 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The flaw exists in the rmmod command implementation, which fails to verify if dependent modules are still loaded before unloading a module, resulting in a use-after-free condition (NVD, NetApp Security).

The vulnerability can allow arbitrary code execution and bypass of UEFI Secure Boot protections. The highest threat from this vulnerability affects data confidentiality and integrity as well as system availability (NVD, Ubuntu Security).

The vulnerability requires local access and high privileges for exploitation. While the attack complexity is low, it requires no user interaction and can affect security-critical components of the system (NetApp Security).

The vulnerability has been fixed in grub2 version 2.06. Users are advised to upgrade to this version or later. After upgrading, it is necessary to run the grub-install command with appropriate system-specific options to complete the mitigation (Gentoo Security, Red Hat Bugzilla).