CVE-2024-45776: Grub2: grub-core/gettext: integer overflow leads to heap oob write and read.
When reading language .mo file in grubmofileopen(), grub2 fails to verify to a integer overflow when allocating its internal buffer. A crafted .mo file may lead to the buffer size calculation to overflow leading to Out-of-bound reads and writes. An attacker may leverage this flaw to leak sensitive data or overwrite critical data possibly leading to the circumvention of secure boot protections.
Other sources
When reading the language .mo file in grubmofileopen(), grub2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead the buffer size calculation to overflow, leading to out-of-bound reads and writes. This flaw allows an attacker to leak sensitive data or overwrite critical data, possibly circumventing secure boot protections.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45776?
CVE-2024-45776 has been classified as a high severity vulnerability due to the potential for out-of-bounds reads and writes.
How do I fix CVE-2024-45776?
To remediate CVE-2024-45776, update to the latest version of GRUB2 that includes the patch addressing this vulnerability.
What systems are affected by CVE-2024-45776?
CVE-2024-45776 affects systems using the GNU GRUB2 bootloader, particularly those processing crafted .mo files.
What vulnerabilities arise from CVE-2024-45776?
CVE-2024-45776 can lead to potential out-of-bounds reads and writes, allowing an attacker to exploit the buffer overflow.
When was CVE-2024-45776 reported?
CVE-2024-45776 was reported in 2024, highlighting a critical flaw in the buffer management of GRUB2.