Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-45782
CVE-2024-45782:
Linux Debian vulnerability analysis and mitigation
Overview
A vulnerability was discovered in the HFS filesystem component of GRUB2 (CVE-2024-45782). When reading an HFS volume's name at grubfsmount(), the HFS filesystem driver performs a strcpy() operation using the user-provided volume name as input without properly validating the volume name's length (NVD, OSS Security).
Technical details
The vulnerability is classified as a heap-based out-of-bounds write (CWE-787) and a classic buffer overflow (CWE-120). The issue occurs specifically in the HFS filesystem driver at fs/hfs.c:382. The CVSS v3.1 base score is rated as 7.8 HIGH by NVD (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and 6.7 MEDIUM by Red Hat (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) (NVD).
Impact
This vulnerability can lead to heap-based out-of-bounds writes, impacting GRUB's sensitive data integrity. The most severe potential consequence is the bypass of secure boot protections. The vulnerability affects GRUB2 version 2.12 and various Red Hat Enterprise Linux versions including 7.0, 8.0, and 9.0, as well as Red Hat OpenShift Container Platform 4.0 (NVD).
Mitigation and workarounds
The vulnerability has been reported and tracked in Red Hat's bug tracking system. Users are advised to apply security updates when they become available. The issue is being tracked under Red Hat Bugzilla ID 2345858 (Red Hat Bugzilla).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management