CVE-2024-45780

Katalog CVE

CVSS 6.7 · Medium EPSS 0,29%

Kerentanan Out-of-bounds Write pada gnu grub2. Skor CVSS 3.1 6.7 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. However, it fails to properly verify the allocation against possible integer overflows. It's possible to cause the allocation length to overflow with a crafted tar file, leading to a heap out-of-bounds write. This flaw eventually allows an attacker to circumvent secure boot protections.

Rincian

Terbit di NVD

3 Maret 2025

Terakhir diubah

29 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2024-45780 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2345856 issue tracking
• https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html mailing list