CVE-2024-45780
Last modified
CVE-2024-45780 is a medium-severity vulnerability rated 6.7/10 on the CVSS scale. A flaw was found in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
A flaw was found in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. However, it fails to properly verify the allocation against possible integer overflows. It's possible to cause the allocation length to overflow with a crafted tar file, leading to a heap out-of-bounds write. This flaw eventually allows an attacker to circumvent secure boot protections.
Metrics
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Grub2 | <= 2.12 |
References
- https://access.redhat.com/security/cve/CVE-2024-45780Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2345856Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-45780?
How severe is CVE-2024-45780?
How do I fix CVE-2024-45780?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-45775A flaw was found in grub2 where the grub_extcmd_dispatcher()…5.2
- CVE-2024-45776When reading the language .mo file in grub_mofile_open(), gr…6.7
- CVE-2024-45777A flaw was found in grub2. The calculation of the translatio…6.7
- CVE-2024-45778A stack overflow flaw was found when reading a BFS file syst…5.5
- CVE-2024-45779An integer overflow flaw was found in the BFS file system dr…6
- CVE-2024-4578This Advisory describes an issue that impacts Arista Wireles…8.4
- CVE-2024-45781A flaw was found in grub2. When reading a symbolic link's na…6.7
- CVE-2024-45782A flaw was found in the HFS filesystem. When reading an HFS …7.8
- CVE-2024-45783A flaw was found in grub2. When failing to mount an HFS+ gru…4.4
- CVE-2024-45784Apache Airflow versions before 2.10.3 contain a vulnerabilit…7.5
- CVE-2024-45785MUSASI version 3 contains an issue with use of client-side a…7.5
- CVE-2024-45786This vulnerability exists in Reedos aiM-Star version 2.0.1 d…6.5
Are you affected by CVE-2024-45780?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST