REDHAT-BUG-2346343: Medium severity GNU GRUB vulnerability
The calculation of the translation buffer when reading a language .mo file in grubgettextgetstrfromposition() may overflow leading to a Out-of-bound write. This may be leveraged by an attacker to overwrite senstive grub2's heap data, eventually leading to the circumvention of secure boot protections.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2346343?
The severity of REDHAT-BUG-2346343 is high due to the potential for an out-of-bounds write that can lead to a secure boot circumvention.
How do I mitigate REDHAT-BUG-2346343?
To mitigate REDHAT-BUG-2346343, ensure that you are using the latest version of GNU GRUB with the applied patches.
Who is affected by REDHAT-BUG-2346343?
Users of GNU GRUB are affected by REDHAT-BUG-2346343, especially those utilizing secure boot configurations.
What can an attacker achieve by exploiting REDHAT-BUG-2346343?
An attacker exploiting REDHAT-BUG-2346343 may overwrite sensitive heap data in grub2, which can compromise the integrity of secure boot.
How does the vulnerability in REDHAT-BUG-2346343 occur?
The vulnerability in REDHAT-BUG-2346343 occurs due to an overflow in the calculation of the translation buffer when reading a language .mo file.