CVE-2024-45780

March 7, 2025, 10:14 p.m.

6.7
Medium

Description

A flaw was found in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. However, it fails to properly verify the allocation against possible integer overflows. It's possible to cause the allocation length to overflow with a crafted tar file, leading to a heap out-of-bounds write. This flaw eventually allows an attacker to circumvent secure boot protections.

Product(s) Impacted

Vendor Product Versions
Gnu
  • Grub2
  • *

Weaknesses

CWE-787
Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.

*CPE(s)

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a gnu grub2 / / / / / / / /

References

https://access.redhat.com/security/cve/CVE-2024-45780
https://bugzilla.redhat.com/show_bug.cgi?id=2345856
https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html

Tags

secalert@redhat.com
CWE-787
2025-03-03
CVE-2024-45780

CVSS Score

6.7 / 10

CVSS Data

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: HIGH
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH
    • View Vector String

    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Date

  • Published: March 3, 2025, 3:15 p.m.
  • Last Modified: March 7, 2025, 10:14 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert@redhat.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.