CVE-2024-2312

Katalog CVE

CVSS 6.7 · Medium EPSS 0,38%

Kerentanan Use After Free pada gnu grub2, netapp bootstrap os. Skor CVSS 3.1 6.7 (Medium) menurut ubuntu.com.

Deskripsi (NVD)

GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.

Rincian

Terbit di NVD

5 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.7 (Medium), sumber ubuntu.com
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127 exploit · issue tracking · patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2312 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20240426-0003/ advisory pihak ketiga