VDB
DEBIAN-CVE-2024-45782
DEBIAN-CVE-2024-45782
PUBLISHED
CVSS 7.800000190734863 HIGH
A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer, impacting grub's sensitive data integrity and eventually leading to a secure boot protection bypass.
Risk Scores
CVSS v3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | grub2 | 0, 0 |
| Debian:12 | grub2 | *, 0, 2.06-13 |
| Debian:11 | grub2 | 2.12-6, 2.12-8, 2.12-9 |
| Debian:14 | grub2 | 0, 0 |
Timeline
- Mar 3, 2025 CVE Published
- May 16, 2026 CVE Updated