12 results · Clear filters · Feed
-
High 7.8
Grub2: missing unregister call for gettext command may lead to use-after-free
A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the o…
-
High 7.8
Grub2: squash4: integer overflow may lead to heap based out-of-bounds write when reading data
A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A malicio…
-
High 7.8
Grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382)
A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read …
-
High 7.8
Grub2: udf: heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution
When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buffers. In certain scenarios, while iterating through disk sectors, it assumes the read size from the disk is always smal…
-
High 7.8
Grub2: fs/hfs: integer overflow may lead to heap based out-of-bounds write
When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal buffers size, however it misses to properly check for integer overflows. A maliciouly crafted filesyst…
-
High 7.6
Grub2: net: out-of-bounds write in grub_net_search_config_file()
A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to …
-
High 8.8
GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesy…
-
High 7.5
Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution
An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the …
-
High 8.1
Out-of-bounds write when handling split HTTP headers
Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a N…
-
High 8.1
Integer underflow in grub_net_recv_ip4_packets
Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a sma…
-
High 7.1
When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and h…
-
High 8.6
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when c…