CVE-2024-45777

Description

A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in grub_gettext_getstr_from_position() may overflow, leading to a Out-of-bound write. This issue can be leveraged by an attacker to overwrite grub2's sensitive heap data, eventually leading to the circumvention of secure boot protections.

CVSS breakdown

Affected products

• gnu / grub22.12
• RedHat / enterprise_linux7.0 – 7.0
• RedHat / enterprise_linux8.0 – 8.0
• RedHat / enterprise_linux9.0 – 9.0
• RedHat / enterprise_linux10.0 – 10.0
• RedHat / openshift4.0 – 4.0

References

• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:20532
• VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2024-45777
• MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2346343