Vulnerability Description
A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not be removed and may fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Grub2 | - |
| Redhat | Enterprise Linux | 8.0 |
| Fedoraproject | Fedora | 40 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2024:2456
- https://access.redhat.com/errata/RHSA-2024:3184
- https://access.redhat.com/security/cve/CVE-2024-1048Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2256827Issue TrackingVendor Advisory
- https://www.openwall.com/lists/oss-security/2024/02/06/3Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/02/06/3
- https://access.redhat.com/errata/RHSA-2024:2456
- https://access.redhat.com/errata/RHSA-2024:3184
- https://access.redhat.com/security/cve/CVE-2024-1048Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2256827Issue TrackingVendor Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]
- https://lists.fedoraproject.org/archives/list/[email protected]
- https://security.netapp.com/advisory/ntap-20240223-0007/
- https://www.openwall.com/lists/oss-security/2024/02/06/3Mailing ListThird Party Advisory
FAQ
What is CVE-2024-1048?
CVE-2024-1048 is a vulnerability with a CVSS score of 3.3 (LOW). A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original...
How severe is CVE-2024-1048?
CVE-2024-1048 has been rated LOW with a CVSS base score of 3.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-1048?
Check the references section above for vendor advisories and patch information. Affected products include: Gnu Grub2, Redhat Enterprise Linux, Fedoraproject Fedora.