CVE-2024-45779
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
An integer overflow vulnerability was found in the BFS file system driver in GRUB2. When reading a file with an indirect extent map, GRUB2 fails to validate the number of extent entries, leading to a heap out-of-bounds read.
Risk Assessment
The risk includes potential sensitive data leakage or GRUB2 crash, which may prevent system boot and compromise data confidentiality.
Recommendation
It is recommended to immediately update GRUB2 to the latest patched version and avoid using untrusted or corrupted BFS file systems.
Original NVD description (English source)
An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an indirect extent map, grub2 fails to validate the number of extent entries to be read. A crafted or corrupted BFS filesystem may cause an integer overflow during the file reading, leading to a heap of bounds read. As a consequence, sensitive data may be leaked, or grub2 will crash.