CVE-2024-45775: Grub2: commands/extcmd: missing check for failed allocation
A flaw was found in grub2 where the grubextcmddispatcher() function calls grubarglistalloc() to allocate memory for the grub's argument list. However, it fails to check in case the memory allocation fails. Once the allocation fails, a NULL point will be processed by the parseoption() function, leading grub to crash or, in some rare scenarios, corrupt the IVT data.
Other sources
In grubextcmddispatcher() function grub2 calls grubarglistalloc() to allocate memory for the grub's argument list, however it misses to check in case the memory allocation failed. Once the allocation failed, a NULL point will be processed by the parseoption() function leading grub to crash or in some rare scenarios corrupt the IVT data.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45775?
CVE-2024-45775 has been designated as a medium severity vulnerability.
How do I fix CVE-2024-45775?
To fix CVE-2024-45775, update to the latest version of GNU GRUB2 that includes the security patch addressing this vulnerability.
What systems are affected by CVE-2024-45775?
CVE-2024-45775 affects systems running GNU GRUB2 without the proper memory allocation checks.
What type of vulnerability is CVE-2024-45775?
CVE-2024-45775 is a memory allocation failure vulnerability that can lead to processing a NULL pointer.
Is CVE-2024-45775 exploitable?
Yes, CVE-2024-45775 is potentially exploitable due to the lack of checks on memory allocation failures.