CVE-2024-45782

CWE-787 — Out-of-bounds WriteCWE-120 — Classic Buffer Overflow7 documents7 sources
Severity
7.8HIGH
EPSS
0.0%
top 99.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GNU Grub2Redhat Enterprise LinuxRedhat Openshift Container Platform
Timeline
PublishedMar 3
Latest updateMar 11

Description

A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer, impacting grub's sensitive data integrity and eventually leading to a secure boot protection bypass.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶Debiangrub2< 2.12-6+1
▶NVDgnu/grub22.12

Also affects: Enterprise Linux 7.0, 8.0, 9.0, Openshift Container Platform 4.0

🔴Vulnerability Details

3
OSV
CVE-2024-45782: A flaw was found in the HFS filesystem↗2025-03-03
▶
CVEList
Grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382)↗2025-03-03
▶
GHSA
GHSA-pgf7-qmfm-349p: A flaw was found in the HFS filesystem↗2025-03-03
▶

📋Vendor Advisories

3
Microsoft
Grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382)↗2025-03-11
▶
Red Hat
grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382)↗2025-02-18
▶
Debian
CVE-2024-45782: grub2 - A flaw was found in the HFS filesystem. When reading an HFS volume's name at gru...↗2024
▶