CVE-2024-45775
MediumCVSS 5.2Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the argument list, but fails to check if the allocation succeeded. If allocation fails, the parse_option() function processes a NULL pointer, causing grub to crash or, in rare scenarios, corrupt IVT data.
Risk Assessment
The risk involves potential system crash during boot or corruption of critical IVT data, which may prevent the operating system from booting correctly.
Recommendation
It is recommended to immediately update the grub2 package to a version containing the fix for this vulnerability, available from the Linux distribution vendor's repositories.
Original NVD description (English source)
A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the grub's argument list. However, it fails to check in case the memory allocation fails. Once the allocation fails, a NULL point will be processed by the parse_option() function, leading grub to crash or, in some rare scenarios, corrupt the IVT data.