CVE-2024-45775 — Unchecked Return Value in Grub2

CWE-252 — Unchecked Return Value6 documents6 sources
Severity
5.2MEDIUMNVD
EPSS
0.0%
top 92.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
GNU Grub2Debian Grub2Msrc Azl3 Grub2 2.06-24 ON Azure Linux 3.0+3 more
Timeline
PublishedFeb 18

Description

A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the grub's argument list. However, it fails to check in case the memory allocation fails. Once the allocation fails, a NULL point will be processed by the parse_option() function, leading grub to crash or, in some rare scenarios, corrupt the IVT data.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:HExploitability: 0.5 | Impact: 4.7

Affected Packages6 packages

▶debiandebian/grub2< grub2 2.12-6 (forky)
▶Debiangnu/grub2< 2.12-6+1

🔴Vulnerability Details

2
GHSA
GHSA-pf8f-3pq9-mrv7: A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the grub's argument list↗2025-02-18
▶
OSV
CVE-2024-45775: A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the grub's argument list↗2025-02-18
▶

📋Vendor Advisories

3
Microsoft
Grub2: commands/extcmd: missing check for failed allocation↗2025-02-11
▶
Red Hat
grub2: commands/extcmd: Missing check for failed allocation↗2025-01-28
▶
Debian
CVE-2024-45775: grub2 - A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub...↗2024
▶