Bug 2346343 (CVE-2024-45777)

Summary: CVE-2024-45777 grub2: grub-core/gettext: Integer overflow leads to Heap OOB Write.
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in grub_gettext_getstr_from_position() may overflow, leading to a Out-of-bound write. This issue can be leveraged by an attacker to overwrite grub2's sensitive heap data, eventually leading to the circumvention of secure boot protections.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-02-18 19:46:45 UTC 
The calculation of the translation buffer when reading a language .mo file in grub_gettext_getstr_from_position() may overflow leading to a Out-of-bound write. This may be leveraged by an attacker to overwrite senstive grub2's heap data, eventually leading to the circumvention of secure boot protections.
Comment 2 errata-xmlrpc 2025-11-11 10:30:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:20532 https://access.redhat.com/errata/RHSA-2025:20532