CVE-2024-45782 is a heap-based out-of-bounds write vulnerability in the HFS filesystem driver within GRUB2, affecting GNU and Red Hat Enterprise Linux and OpenShift Container Platform. This flaw occurs during HFS volume name processing due to improper length validation, potentially compromising GRUB's data integrity and bypassing secure boot. With a CVSS score of 7.8 (High), it can be exploited locally with low complexity to achieve high impact on confidentiality, integrity, and availability. Currently, there is no public exploit code, Metasploit modules, or significant community discussion or media coverage, indicating a low likelihood of active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.12CPE matchmatch criteria | cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* | ||
4.0CPE matchmatch criteria | cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.