Search for vulnerabilities
Vulnerability details: VCID-5v25-3fq8-hbh7
Vulnerability ID VCID-5v25-3fq8-hbh7
Aliases CVE-2024-45780
Summary A flaw was found in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. However, it fails to properly verify the allocation against possible integer overflows. It's possible to cause the allocation length to overflow with a crafted tar file, leading to a heap out-of-bounds write. This flaw eventually allows an attacker to circumvent secure boot protections.
Status Published
Exploitability 0.5
Weighted Severity 6.0
Risk 3.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-190 Integer Overflow or Wraparound
CWE-787 Out-of-bounds Write
System Score Found at
cvssv3 6.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-45780.json
cvssv3.1 6.7 https://access.redhat.com/security/cve/CVE-2024-45780
ssvc Track https://access.redhat.com/security/cve/CVE-2024-45780
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2024-45780
cvssv3.1 6.7 https://bugzilla.redhat.com/show_bug.cgi?id=2345856
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2345856
cvssv3.1 6.4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 6.7 https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
ssvc Track https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
cvssv3.1 6.7 https://nvd.nist.gov/vuln/detail/CVE-2024-45780
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-45780.json
https://api.first.org/data/v1/epss?cve=CVE-2024-45780
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45780
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1098319 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098319
2345856 https://bugzilla.redhat.com/show_bug.cgi?id=2345856
cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*
cpe:/a:redhat:openshift:4 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9
CVE-2024-45780 https://access.redhat.com/security/cve/CVE-2024-45780
CVE-2024-45780 https://nvd.nist.gov/vuln/detail/CVE-2024-45780
msg00024.html https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-45780.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/security/cve/CVE-2024-45780
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-03-03T15:07:37Z/ Found at https://access.redhat.com/security/cve/CVE-2024-45780
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=2345856
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-03-03T15:07:37Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2345856
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-03-03T15:07:37Z/ Found at https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-45780
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.02465
EPSS Score 0.00018
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2024-11-22T05:59:53.665418+00:00 SUSE Severity Score Importer Import https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml 35.0.0