CVE-2024-45782

HIGH EPSS 9.4%

Published Mar 3, 20251y ago · Modified Jun 17, 20262w ago

7.8 CVSS 3.1

High

Published Mar 3, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer, impacting grub's sensitive data integrity and eventually leading to a secure boot protection bypass.

CVSS Details

Base Score

7.8

Exploitability

1.8

Impact

5.9

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

9.4% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 5

Vendor	Product	Version	Range
gnu	grub2	*	≤2.12
redhat	openshift_container_platform	4.0	any
redhat	enterprise_linux	7.0	any
redhat	enterprise_linux	8.0	any
redhat	enterprise_linux	9.0	any

References 2

access.redhat.com https://access.redhat.com/security/cve/CVE-2024-45782

Broken Link
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2345858

Issue Tracking

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.