Search for vulnerabilities
Vulnerability details: VCID-qdpn-t7u4-h7c8
Vulnerability ID VCID-qdpn-t7u4-h7c8
Aliases CVE-2024-45779
Summary An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an indirect extent map, grub2 fails to validate the number of extent entries to be read. A crafted or corrupted BFS filesystem may cause an integer overflow during the file reading, leading to a heap of bounds read. As a consequence, sensitive data may be leaked, or grub2 will crash.
Status Published
Exploitability 0.5
Weighted Severity 5.4
Risk 2.7
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-190 Integer Overflow or Wraparound
System Score Found at
cvssv3 6.0 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-45779.json
cvssv3.1 6 https://access.redhat.com/security/cve/CVE-2024-45779
ssvc Track https://access.redhat.com/security/cve/CVE-2024-45779
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2024-45779
cvssv3.1 6 https://bugzilla.redhat.com/show_bug.cgi?id=2345854
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2345854
cvssv3.1 6.4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 6 https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
ssvc Track https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
cvssv3.1 6.0 https://nvd.nist.gov/vuln/detail/CVE-2024-45779
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-45779.json
https://api.first.org/data/v1/epss?cve=CVE-2024-45779
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45779
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1098319 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098319
2345854 https://bugzilla.redhat.com/show_bug.cgi?id=2345854
cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*
cpe:/a:redhat:openshift:4 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9
CVE-2024-45779 https://access.redhat.com/security/cve/CVE-2024-45779
CVE-2024-45779 https://nvd.nist.gov/vuln/detail/CVE-2024-45779
msg00024.html https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-45779.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H Found at https://access.redhat.com/security/cve/CVE-2024-45779
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-03T15:05:17Z/ Found at https://access.redhat.com/security/cve/CVE-2024-45779
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=2345854
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-03T15:05:17Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2345854
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H Found at https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-03T15:05:17Z/ Found at https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-45779
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.02465
EPSS Score 0.00018
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2024-11-22T05:59:53.456475+00:00 SUSE Severity Score Importer Import https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml 35.0.0