CVE-2024-45775: 
Rocky Linux vulnerability analysis and mitigation

A vulnerability was discovered in GRUB2 (CVE-2024-45775) where the grubextcmddispatcher() function fails to check for failed memory allocation when calling grubarglist_alloc() to allocate memory for GRUB's argument list. The vulnerability was disclosed on February 18, 2025, affecting various versions of GRUB2 across multiple Linux distributions (NVD, Red Hat).

The vulnerability stems from a missing validation check in the grubextcmddispatcher() function after calling grubarglistalloc(). When memory allocation fails, a NULL pointer is subsequently processed by the parseoption() function. The vulnerability has been assigned a CVSS v3.1 base score of 5.2 (Medium) with the vector string CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H (OSS Security).

When exploited, this vulnerability can lead to system crashes or, in rare scenarios, corruption of the IVT (Interrupt Vector Table) data. The impact includes potential system instability and possible data integrity issues (Debian Security).

A fix has been released in the GRUB2 codebase. Debian has addressed this in version 2.12-7 for the sid release. Other distributions are in the process of releasing patches. Users are advised to update their GRUB2 installations once patches are available through their respective distribution channels (Debian Security).