Bug 2345857 (CVE-2024-45781) - CVE-2024-45781 grub2: fs/ufs: OOB write in the heap
Summary: CVE-2024-45781 grub2: fs/ufs: OOB write in the heap
Keywords:
Status: NEW
Alias: CVE-2024-45781
Deadline: 2025-02-18
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2346331 2346334 2346335 2346332 2346333
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-02-14 21:33 UTC by OSIDB Bzimport
Modified: 2025-05-13 08:41 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:6990 0 None None None 2025-05-13 08:41:14 UTC

Description OSIDB Bzimport 2025-02-14 21:33:14 UTC 
When reading a symbolic link's name from a UFS filesystem, grub2 fails to validate the string length taken as an input. The lack of validation may lead to a heap Out-of-bounds write, causing data integrity issues and eventually allowing an attacker to circumvent secure boot protections.
Comment 2 errata-xmlrpc 2025-05-13 08:41:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:6990 https://access.redhat.com/errata/RHSA-2025:6990
Note You need to log in before you can comment on or make changes to this bug.