Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-45779: grub2: fs/bfs: Integer overflow leads to Heap OOB Read in the BFS parser CVE-2024-45778: grub2: fs/bfs: Integer overflow in the BFS parser. CVE-2024-45777: A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in grub_gettext_getstr_from_position() may overflow, leading to a Out-of-bound write. This issue can be leveraged by an attacker to overwrite grub2's sensitive heap data, eventually leading to the circumvention of secure boot protections. CVE-2024-45776: When reading the language .mo file in grub_mofile_open(), grub2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead the buffer size calculation to overflow, leading to out-of-bound reads and writes. This flaw allows an attacker to leak sensitive data or overwrite critical data, possibly circumventing secure boot protections.
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | grub2 | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-common | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-debuginfo | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-efi-aa64 | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-efi-aa64-cdboot | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-efi-aa64-ec2 | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-efi-aa64-modules | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-efi-x64 | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-efi-x64-cdboot | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-efi-x64-ec2 | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-efi-x64-modules | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-emu | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-emu-modules | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-pc | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-pc-modules | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-tools | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-tools-efi | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-tools-extra | 1:2.06-14.amzn2.0.6 |
| Amazon Linux · 2 | grub2-tools-minimal | 1:2.06-14.amzn2.0.6 |
Vulnerabilities 4
-
Medium 6.7
Grub2: grub-core/gettext: integer overflow leads to heap oob write and read.
When reading the language .mo file in grub_mofile_open(), grub2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead the buffer size calculation to overflow, leading to out-of-bound reads and writes. This flaw a…
-
Medium 6.7
Grub2: grub-core/gettext: integer overflow leads to heap oob write.
A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in grub_gettext_getstr_from_position() may overflow, leading to a Out-of-bound write. This issue can be leveraged by an attacker to overwrite grub2's sensiti…
-
Medium 6.0
Grub2: fs/bfs: integer overflow leads to heap oob read in the bfs parser
An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an indirect extent map, grub2 fails to validate the number of extent entries to be read. A crafted or corrupted BFS filesystem may cause an integer overflow du…
-
Medium 4.1
Grub2: fs/bfs: integer overflow in the bfs parser.
A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash.