Nixpkgs Security Tracker

Untriaged

Permalink CVE-2024-45782

6.7 MEDIUM

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): LOW
Privileges required (PR): HIGH
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): HIGH

created 6 months, 1 week ago

Grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382)

A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer, impacting grub's sensitive data integrity and eventually leading to a secure boot protection bypass.

References

https://access.redhat.com/security/cve/CVE-2024-45782 x_refsource_REDHAT vdb-entry
RHBZ#2345858 issue-tracking x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-45782 x_refsource_REDHAT vdb-entry
RHBZ#2345858 issue-tracking x_refsource_REDHAT
RHBZ#2345858 issue-tracking x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-45782 x_refsource_REDHAT vdb-entry
https://access.redhat.com/security/cve/CVE-2024-45782 x_refsource_REDHAT vdb-entry
RHBZ#2345858 issue-tracking x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-45782 x_refsource_REDHAT vdb-entry
RHBZ#2345858 issue-tracking x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-45782 x_refsource_REDHAT vdb-entry
RHBZ#2345858 issue-tracking x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-45782 x_refsource_REDHAT vdb-entry
RHBZ#2345858 issue-tracking x_refsource_REDHAT

Affected products

grub2

=<2.12

rhcos

Matching in nixpkgs

pkgs.grub2_pvgrub_image

PvGrub2 image for booting PV Xen guests

nixos-unstable -
- nixpkgs-unstable

pkgs.grub2_pvhgrub_image

PvGrub2 image for booting PVH Xen guests

nixos-unstable -
- nixpkgs-unstable

Package maintainers