CVE-2024-45777: Grub2: grub-core/gettext: integer overflow leads to heap oob write.
A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in grubgettextgetstrfromposition() may overflow, leading to a Out-of-bound write. This issue can be leveraged by an attacker to overwrite grub2's sensitive heap data, eventually leading to the circumvention of secure boot protections.
Other sources
The calculation of the translation buffer when reading a language .mo file in grubgettextgetstrfromposition() may overflow leading to a Out-of-bound write. This may be leveraged by an attacker to overwrite senstive grub2's heap data, eventually leading to the circumvention of secure boot protections.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45777?
CVE-2024-45777 has been classified as a critical severity vulnerability due to the potential for an attacker to overwrite sensitive heap data.
How do I fix CVE-2024-45777?
To fix CVE-2024-45777, update to the latest stable version of GNU GRUB 2 that addresses this vulnerability.
What could be the impact of exploiting CVE-2024-45777?
Exploiting CVE-2024-45777 may allow an attacker to perform arbitrary code execution by overwriting critical memory areas in GRUB 2.
Which versions of GRUB 2 are affected by CVE-2024-45777?
CVE-2024-45777 affects certain versions of GNU GRUB 2 prior to the patch addressed in the latest release.
How can an attacker exploit CVE-2024-45777?
An attacker can exploit CVE-2024-45777 by manipulating the language .mo files processed by GRUB 2, leading to a potential out-of-bounds write.