What is happening now with the Grub backspace key security vulnerability?

The main thing that is happening is that the bug is being seriously overhyped.

  • Exploiting this vulnerability requires physical access to the computer during startup, and if you've got physical access, there are about a zillion ways you can bypass security.
  • The bug is about bypassing Grub2's internal password protection. Most users don't password-protect Grub2.
  • The bug is in the Grub2 bootloader. If you're using direct boot from UEFI, LILO, classic Grub, or any of the non-x86 bootloaders, you're not vulnerable to it.

If you're worried about this bug, install your distro's patch for it, but keep in mind that, except in unusual circumstances, the vulnerability doesn't actually reduce security.


Your question is the first I've heard of this. Based on the articles you presented though you're probably plenty safe for 2 reasons:

A) The first article you linked says that the major distros have already patched this. If you keep up to date like you said, it should be fine. If not, the same article says the researchers who found the bug have released a patch you can install yourself

B) The attack isn't against the Linux kernel, it's against the bootloader. That means an attacker needs to have access to your machine itself, not just network access to it. So unless you have friends or family who are inclined to hack your computer while you sleep you should be safe.

Bonus) Once you have the physical access to a computer which you'd need for a hack like this (barring weird setups like network KVM switches) there are easier ways to gain control of the machine