CVE-2024-45782

A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer, impacting grub's sensitive data integrity and eventually leading to a secure boot protection bypass.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2024-45782	Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=2345858	Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:redhat:openshift_container_platform:4.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

History

25 Mar 2025, 05:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~6.7~~	v2 : unknown v3 : 7.8

21 Mar 2025, 16:15

Type	Values Removed	Values Added
References	~~() https://access.redhat.com/security/cve/CVE-2024-45782 -~~	() https://access.redhat.com/security/cve/CVE-2024-45782 - Broken Link
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2345858 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2345858 - Issue Tracking
CPE		cpe:2.3:o:redhat:enterprise_linux:9.0:::::::* cpe:2.3:o:redhat:enterprise_linux:8.0:::::::* cpe:2.3:a:redhat:openshift_container_platform:4.0:::::::* cpe:2.3:a:gnu:grub2:::::::: cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
CWE	~~CWE-120~~	CWE-787
Summary		(es) Se encontró una falla en HFS filesystem. Al leer el nombre de un volumen HFS en grub_fs_mount(), el controlador de HFS filesystem realiza una operación strcpy() utilizando el nombre del volumen proporcionado por el usuario como entrada sin validar correctamente la longitud del nombre del volumen. Este problema puede leerse en un escritor fuera de los límites basado en el montón, lo que afecta la integridad de los datos confidenciales de grub y, finalmente, conduce a una omisión de la protección de arranque seguro.
First Time		Redhat enterprise Linux Gnu grub2 Redhat Redhat openshift Container Platform Gnu

03 Mar 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-03 17:15

Updated : 2025-03-25 05:15

NVD link : CVE-2024-45782

Mitre link : CVE-2024-45782

CVE.ORG link : CVE-2024-45782

JSON object : View

Products Affected

gnu

grub2

redhat

openshift_container_platform
enterprise_linux

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2024-45782", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2025-03-03T17:15:12.900", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2024-45782", "tags": ["Broken Link"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345858", "tags": ["Issue Tracking"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer, impacting grub's sensitive data integrity and eventually leading to a secure boot protection bypass."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en HFS filesystem. Al leer el nombre de un volumen HFS en grub_fs_mount(), el controlador de HFS filesystem realiza una operaci\u00f3n strcpy() utilizando el nombre del volumen proporcionado por el usuario como entrada sin validar correctamente la longitud del nombre del volumen. Este problema puede leerse en un escritor fuera de los l\u00edmites basado en el mont\u00f3n, lo que afecta la integridad de los datos confidenciales de grub y, finalmente, conduce a una omisi\u00f3n de la protecci\u00f3n de arranque seguro."}], "lastModified": "2025-03-25T05:15:39.933", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6ECC2401-511C-4A2E-878F-C7053FA3ABB1", "versionEndIncluding": "2.12"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "932D137F-528B-4526-9A89-CD59FA1AB0FE"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}

7.8 /10