Integer Overflow Vulnerability in GRUB2 Affecting Red Hat Products

CVE-2024-45776

Summary

In the GRUB2 bootloader, a flaw exists within the grub_mofile_open() function, which does not properly validate the integer size when processing .mo language files. This oversight can result in an overflow during the allocation of internal buffers. An attacker could exploit this vulnerability by crafting a malicious .mo file, potentially allowing for out-of-bound read and write operations. Such exploitation could lead to the leakage of sensitive data or the corruption of critical data, putting secure boot mechanisms at risk.

References