Heap Out-of-Bounds Write Vulnerability in GRUB2 Affects Debian 13 and 14
Summary
DEBIAN-CVE-2024-45781: A flaw was found in grub2. Affects grub2 versions < 2.12-6. Fixed in 2.12-6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GRUB2 (GRand Unified Bootloader version 2) is a widely used bootloader for Linux systems, responsible for loading the operating system and managing boot processes. It supports various filesystems and is known for its flexibility and configurability. However, a recent vulnerability has been identified that affects its ability to handle symbolic links on UFS filesystems, potentially compromising system integrity.
Vulnerability Detail
A flaw was found in GRUB2 when reading a symbolic link's name from a UFS filesystem. The vulnerability arises from the failure to validate the string length of the input, which can lead to a heap out-of-bounds write. This lack of validation may cause data integrity issues and could allow an attacker to circumvent secure boot protections, posing a significant risk to system security.
How To Fix
Minimum fixed version
2.12-6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade grub2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using UFS filesystems until the package is updated. Additionally, consider disabling secure boot if it is not essential for your system's operation.
Conclusion
The identified vulnerability in GRUB2 poses a serious risk to systems using Debian 13 and 14, particularly those utilizing UFS filesystems. It is crucial for users to update to the patched version 2.12-6 to safeguard their systems against potential exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for grub2 →
FAQ
The vulnerability can lead to heap out-of-bounds writes, which may compromise data integrity and allow attackers to bypass secure boot protections.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without any signup.
The vulnerability affects GRUB2 versions prior to 2.12-6 in both Debian 13 and 14.
Yes, the patched version of GRUB2 is 2.12-6. Users should update to this version to mitigate the vulnerability.
If immediate updating is not possible, consider using alternative filesystems instead of UFS and disabling secure boot as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for grub2.
