Medium ALAS2-2025-2756 1 CVE

Moderate: grub2 security update (Amazon Linux 2)

Published Feb 12, 2025 · Updated Feb 25, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-56737: GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem.

Fixed packages 19

Release	Package	Fixed in
Amazon Linux · 2	grub2	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-common	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-debuginfo	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-efi-aa64	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-efi-aa64-cdboot	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-efi-aa64-ec2	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-efi-aa64-modules	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-efi-x64	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-efi-x64-cdboot	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-efi-x64-ec2	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-efi-x64-modules	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-emu	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-emu-modules	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-pc	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-pc-modules	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-tools	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-tools-efi	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-tools-extra	1:2.06-14.amzn2.0.5
Amazon Linux · 2	grub2-tools-minimal	1:2.06-14.amzn2.0.5

Vulnerabilities 1

High 8.8

CVE-2024-56737

GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesy…

GNU grub2 grub2 grub2-signed Debian Ubuntu Azure Linux

Dec 29, 2024

References

web
https://alas.aws.amazon.com/cve/html/CVE-2024-56737.html