CVE-2024-45780: Grub2: fs/tar: integer overflow causes heap oob write
First published: Fri Feb 14 2025(Updated: )
A flaw was found in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. However, it fails to properly verify the allocation against possible integer overflows. It's possible to cause the allocation length to overflow with a crafted tar file, leading to a heap out-of-bounds write. This flaw eventually allows an attacker to circumvent secure boot protections.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CentOS Grub2-pc-modules |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-45780?
CVE-2024-45780 has been rated as high severity due to the risk of integer overflow leading to potential arbitrary code execution.
How do I fix CVE-2024-45780?
To fix CVE-2024-45780, update your GNU GRUB2 to the latest version that resolves this vulnerability.
What systems are affected by CVE-2024-45780?
CVE-2024-45780 affects systems running GNU GRUB2, specifically those using the tar file reading functionality.
What are the consequences of exploiting CVE-2024-45780?
Exploiting CVE-2024-45780 could lead to arbitrary code execution, potentially compromising the affected system.
Is there a workaround for CVE-2024-45780 if an update is not available?
Currently, there are no reliable workarounds for CVE-2024-45780; updating to a patched version is strongly recommended.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-45780
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/source
- agent/author
- agent/tags
- agent/trending
- agent/event
- vendor/gnu
- canonical/centos grub2-pc-modules