Stack Overflow Vulnerability in GRUB2 Package: Potential Crash from BFS Filesystem
Summary
DEBIAN-CVE-2024-45778: A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash. Affects grub2 versions < 2.12-6. Fixed in 2.12-6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GRUB2 (Grand Unified Bootloader version 2) is a widely used bootloader for various operating systems, including Linux. It is responsible for loading the operating system kernel and managing the boot process. GRUB2 supports various file systems, including BFS (Boot File System), which is utilized in some specialized environments. The vulnerability in question arises from a flaw in how GRUB2 handles BFS file systems, potentially leading to system instability.
Vulnerability Detail
A stack overflow flaw was discovered in GRUB2 when reading a BFS file system. This vulnerability can be exploited by crafting a malicious BFS filesystem that triggers an uncontrolled loop within GRUB2, ultimately causing the bootloader to crash. The flaw poses a significant risk as it can prevent the system from booting, leading to downtime and potential data loss.
How To Fix
Minimum fixed version
2.12-6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade grub2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using BFS file systems with GRUB2 until the package is updated to the patched version. Additionally, users should ensure that their systems are backed up regularly to prevent data loss in case of a crash.
Conclusion
The stack overflow vulnerability in GRUB2 when handling BFS file systems poses a significant risk to system stability. Users are advised to update to the patched version to mitigate this risk. Regular monitoring and backups are essential to safeguard against potential crashes.
See every vulnerability recorded for grub2 →
FAQ
The vulnerability is a stack overflow flaw that occurs when GRUB2 reads a crafted BFS file system, potentially causing it to crash.
The affected versions are prior to 2.12-6 for both Debian 13 and Debian 14.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, avoid using BFS file systems with GRUB2 and ensure regular backups of your system.
More information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-45778.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for grub2.
