CVE-2024-45780
📋 TL;DR
CVE-2024-45780 is a heap buffer overflow vulnerability in grub2's tar file parser that allows integer overflow during filename buffer allocation. Attackers can exploit this with a crafted tar file to write out-of-bounds heap memory, potentially bypassing secure boot protections. Systems using grub2 bootloader with tar support are affected.
💻 Affected Systems
- grub2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete secure boot bypass allowing persistent malware installation at boot time, system compromise, and potential data exfiltration.
Likely Case
Local privilege escalation or boot process manipulation requiring physical access or administrative privileges to place malicious tar files.
If Mitigated
Limited impact if secure boot is properly configured and physical access controls prevent malicious file placement.
🎯 Exploit Status
Exploitation requires ability to place malicious tar files in boot directories, typically requiring local access or administrative privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Distribution-specific (check vendor advisories)
Vendor Advisory: https://access.redhat.com/security/cve/CVE-2024-45780
Restart Required: Yes
Instructions:
1. Check your distribution's security advisory. 2. Update grub2 packages using your package manager. 3. Update grub configuration: 'grub2-mkconfig -o /boot/grub2/grub.cfg'. 4. Reboot system.
🔧 Temporary Workarounds
Disable tar support in grub2
linuxRemove tar module loading from grub configuration to disable vulnerable functionality
Edit /etc/default/grub and remove 'tar' from GRUB_PRELOAD_MODULES
Run: grub2-mkconfig -o /boot/grub2/grub.cfg
🧯 If You Can't Patch
- Restrict physical access to systems and limit administrative privileges
- Implement strict access controls on /boot directory and grub configuration files
🔍 How to Verify
Check if Vulnerable:
Check grub2 version and compare against patched versions in vendor advisoriesCheck Version:
rpm -q grub2 (RHEL/CentOS) or dpkg -l | grep grub (Debian/Ubuntu)Verify Fix Applied:
Verify grub2 package version matches patched version from vendor advisory📡 Detection & Monitoring
Log Indicators:
- Unexpected grub errors during boot
- Failed boot attempts with tar-related errors
Network Indicators:
- None - local exploitation only
SIEM Query:
Search for failed boot events or grub error messages in system logs