REDHAT-BUG-2339182: Integer Overflow
When reading language .mo file in grubmofileopen(), grub2 fails to verify to a integer overflow when allocating its internal buffer. A crafted .mo file may lead to the buffer size calculation to overflow leading to Out-of-bound reads and writes. An attacker may leverage this flaw to leak sensitive data or overwrite critical data possibly leading to the circumvention of secure boot protections.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2339182?
The severity of REDHAT-BUG-2339182 is rated as medium (4).
How do I fix REDHAT-BUG-2339182?
To fix REDHAT-BUG-2339182, update to the latest version of GNU GRUB 2 as patched by the vendor.
What impact does REDHAT-BUG-2339182 have on system security?
REDHAT-BUG-2339182 can lead to out-of-bound reads and writes, potentially allowing an attacker to leak sensitive information.
What causes the vulnerability in REDHAT-BUG-2339182?
The vulnerability in REDHAT-BUG-2339182 is caused by an integer overflow when allocating an internal buffer for reading language .mo files.
Which software versions are affected by REDHAT-BUG-2339182?
REDHAT-BUG-2339182 affects GNU GRUB 2 prior to the patches addressing the issue.