CVE-2024-45779

An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an indirect extent map, grub2 fails to validate the number of extent entries to be read. A crafted or corrupted BFS filesystem may cause an integer overflow during the file reading, leading to a heap of bounds read. As a consequence, sensitive data may be leaked, or grub2 will crash.

To exploit this flaw, an attacker needs to trick a user into running grub2 with a specially crafted BFS file system image, limiting the exposure of this flaw. For this reason, this vulnerability has been rated with a Moderate severity.

The grub2 package as shipped in Red Hat Enterprise Linux 7, 8, 9 and in Red Hat OpenShift Container Platform 4 is not affected by this vulnerability because the BFS module is not built, so this issue is not applicable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.