CVE-2024-45781
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A flaw was found in grub2 where it fails to validate the string length when reading a symbolic link's name from a UFS filesystem. This lack of validation may lead to a heap out-of-bounds write, compromising data integrity and potentially allowing an attacker to bypass Secure Boot protections.
Risk Assessment
The risk for the organization is the potential compromise of system integrity and bypass of Secure Boot protections, which could allow unauthorized code execution during the system boot process.
Recommendation
It is recommended to immediately update the grub2 package to the latest available version containing the fix for this vulnerability and to monitor security advisories from the system distributor.
Original NVD description (English source)
A flaw was found in grub2. When reading a symbolic link's name from a UFS filesystem, grub2 fails to validate the string length taken as an input. The lack of validation may lead to a heap out-of-bounds write, causing data integrity issues and eventually allowing an attacker to circumvent secure boot protections.