CVE-2024-45776
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In the grub_mofile_open() function when reading a language .mo file, GRUB2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead to buffer size calculation overflow, resulting in out-of-bound reads and writes.
Risk Assessment
An attacker can exploit this vulnerability to leak sensitive data or overwrite critical data, potentially bypassing Secure Boot protections. This poses a serious threat to system integrity and confidentiality.
Recommendation
Immediately update GRUB2 to a version containing the fix for this vulnerability. Until the update is applied, avoid loading untrusted .mo files.
Original NVD description (English source)
When reading the language .mo file in grub_mofile_open(), grub2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead the buffer size calculation to overflow, leading to out-of-bound reads and writes. This flaw allows an attacker to leak sensitive data or overwrite critical data, possibly circumventing secure boot protections.