A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlying filesystem superblock, GRUB will fail to locate a valid filesystem and enter rescue mode. At this point, the disk is already decrypted, and the decryption key remains loaded in system memory. This scenario may allow an attacker with physical access to access the unencrypted data without any further authentication, thereby compromising data confidentiality. Furthermore, the ability to force this state through filesystem corruption also presents a data integrity concern.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0411 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-4382:
    A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-     decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the     decryption key into system memory. If an attacker with physical access can corrupt the underlying     filesystem superblock, GRUB will fail to locate a valid filesystem and enter rescue mode. At this point,     the disk is already decrypted, and the decryption key remains loaded in system memory. This scenario may     allow an attacker with physical access to access the unencrypted data without any further authentication,     thereby compromising data confidentiality. Furthermore, the ability to force this state through filesystem     corruption also presents a data integrity concern.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-     decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the     decryption key into system memory. If an attacker with physical access can corrupt the underlying     filesystem superblock, GRUB will fail to locate a valid filesystem and enter rescue mode. At this point,     the disk is already decrypted, and the decryption key remains loaded in system memory. This scenario may     allow an attacker with physical access to access the unencrypted data without any further authentication,     thereby compromising data confidentiality. Furthermore, the ability to force this state through filesystem     corruption also presents a data integrity concern. (CVE-2025-4382)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01747-1 advisory.

    Security fixes:

    - CVE-2025-4382: exposure of data from encrypted device through CLI once the root device is successfully     unlocked via       TPM (bsc#1242971).

    Other bug fixes:

    - Fix incorrect nvme disks and boot order in bootlist output (bsc#1237174).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01615-1 advisory.

    This update for grub2 rebuilds the existing package with the new 4k RSA secure boot key for IBM Power and     Z.

    Note: the signing key of x86 / x86_64 and aarch64 architectures are unchanged.

    Also the following issue were fixed:

    - CVE-2025-4382: TPM auto-decryption data exposure (bsc#1242971)
    - Fix segmentation fault error in grub2-probe with target=hints_string (bsc#1235971) (bsc#1235958)     (bsc#1239651)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
276018	TencentOS Server 4: grub2 (TSSA-2025:0411)	Nessus	Tencent Local Security Checks	medium
251939	Linux Distros Unpatched Vulnerability : CVE-2025-4382	Nessus	Misc.	medium
237563	SUSE SLED15 / SLES15 Security Update : grub2 (SUSE-SU-2025:01747-1)	Nessus	SuSE Local Security Checks	medium
237073	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : grub2 (SUSE-SU-2025:01615-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2025-4382

medium

Tenable Plugins

medium

medium

medium

medium