BDU:2025-03836

Опубликовано: 11 фев. 2025

Источник: fstec

CVSS3: 4.4

CVSS2: 4.6

EPSS Низкий

Описание

Уязвимость драйвера файловой системы hfsplus загрузчика операционных систем Grub2 связана с некорректным манипулированием счётчиком ссылок на ресурс. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Вендор

Novell Inc.

Erich Boleyn

Сообщество свободного программного обеспечения

Red Hat Inc.

Наименование ПО

Suse Linux Enterprise Desktop

Suse Linux Enterprise Server

SUSE Linux Enterprise Module for Basesystem

SUSE CaaS Platform

SUSE Linux Enterprise Point of Sale

SUSE Linux Enterprise Module for Server Applications

SUSE OpenStack Cloud Crowbar

SUSE Enterprise Storage

HPE Helion Openstack

Grub2

SUSE Manager Proxy

SUSE Manager Retail Branch Server

Debian GNU/Linux

SUSE Linux Enterprise High Performance Computing

SUSE Manager Server

SUSE Linux Enterprise Micro

Red Hat OpenShift Container Platform

Red Hat Enterprise Linux

SUSE Linux Enterprise Real Time

openSUSE Leap Micro

SUSE Manager Proxy Module

Версия ПО

12 SP3 (Suse Linux Enterprise Desktop)

12 SP4 (Suse Linux Enterprise Desktop)

12 SP3 (Suse Linux Enterprise Server)

12 SP4 (Suse Linux Enterprise Server)

15 (SUSE Linux Enterprise Module for Basesystem)

15 SP1 (SUSE Linux Enterprise Module for Basesystem)

3.0 (SUSE CaaS Platform)

12 SP2-CLIENT (SUSE Linux Enterprise Point of Sale)

12 SP2-BCL (Suse Linux Enterprise Server)

12 SP2-ESPOS (Suse Linux Enterprise Server)

12 SP2-LTSS (Suse Linux Enterprise Server)

12 SP3-LTSS (Suse Linux Enterprise Server)

15 SP1 (SUSE Linux Enterprise Module for Server Applications)

15 (SUSE Linux Enterprise Module for Server Applications)

12 SP3-BCL (Suse Linux Enterprise Server)

8 (SUSE OpenStack Cloud Crowbar)

6 (SUSE Enterprise Storage)

8 (HPE Helion Openstack)

12 SP3-ESPOS (Suse Linux Enterprise Server)

12 SP2 (Suse Linux Enterprise Desktop)

9 (SUSE OpenStack Cloud Crowbar)

15-LTSS (Suse Linux Enterprise Server)

15 SP2 (SUSE Linux Enterprise Module for Basesystem)

11 SP4 (Suse Linux Enterprise Desktop)

- (Grub2)

15 SP2 (SUSE Linux Enterprise Module for Server Applications)

11 SP2 (Suse Linux Enterprise Server)

10 SP4 LTSS (Suse Linux Enterprise Server)

12 SP4-ESPOS (Suse Linux Enterprise Server)

4.0 (SUSE CaaS Platform)

12 SP4-LTSS (Suse Linux Enterprise Server)

15 SP1-BCL (Suse Linux Enterprise Server)

15 SP1-LTSS (Suse Linux Enterprise Server)

4.0 (SUSE Manager Proxy)

4.0 (SUSE Manager Retail Branch Server)

15 SP3 (SUSE Linux Enterprise Module for Basesystem)

15 SP1 (Suse Linux Enterprise Server)

11 (Debian GNU/Linux)

12 (Debian GNU/Linux)

15 SP3 (SUSE Linux Enterprise High Performance Computing)

15 SP3 (Suse Linux Enterprise Server)

4.2 (SUSE Manager Proxy)

4.2 (SUSE Manager Server)

15 SP3 (Suse Linux Enterprise Desktop)

7 (SUSE Enterprise Storage)

15 SP2 (Suse Linux Enterprise Server)

4.1 (SUSE Manager Server)

4.1 (SUSE Manager Proxy)

5.0 (SUSE Linux Enterprise Micro)

5.1 (SUSE Linux Enterprise Micro)

4.1 (SUSE Manager Retail Branch Server)

15 SP4 (Suse Linux Enterprise Server)

15 SP2 (Suse Linux Enterprise Desktop)

4 (Red Hat OpenShift Container Platform)

15 SP4 (Suse Linux Enterprise Desktop)

15 (Suse Linux Enterprise Server)

15 SP2-BCL (Suse Linux Enterprise Server)

4.2 (SUSE Manager Retail Branch Server)

9 (Red Hat Enterprise Linux)

15 SP2-LTSS (Suse Linux Enterprise Server)

15 SP2 (SUSE Linux Enterprise Real Time)

15 SP4 (SUSE Linux Enterprise High Performance Computing)

15 SP1 (Suse Linux Enterprise Desktop)

15 (Suse Linux Enterprise Desktop)

10 SP4 (Suse Linux Enterprise Server)

5.2 (openSUSE Leap Micro)

15 SP4 (SUSE Linux Enterprise Module for Basesystem)

5.3 (openSUSE Leap Micro)

15 SP3-ESPOS (SUSE Linux Enterprise High Performance Computing)

15 SP3 (SUSE Linux Enterprise Real Time)

15 SP3-BCL (Suse Linux Enterprise Server)

15 SP5 (Suse Linux Enterprise Server)

15 SP5 (Suse Linux Enterprise Desktop)

15 SP5 (SUSE Linux Enterprise High Performance Computing)

15 SP5 (SUSE Linux Enterprise Module for Basesystem)

15 SP4 (SUSE Linux Enterprise Real Time)

5.4 (openSUSE Leap Micro)

5.5 (openSUSE Leap Micro)

6.0 (SUSE Linux Enterprise Micro)

6.1 (SUSE Linux Enterprise Micro)

4.2 (SUSE Manager Proxy Module)

Тип ПО

Операционная система

Прикладное ПО информационных систем

Сетевое средство

Операционные системы и аппаратные платформы

Novell Inc. Suse Linux Enterprise Desktop 12 SP3

Novell Inc. Suse Linux Enterprise Desktop 12 SP4

Novell Inc. Suse Linux Enterprise Server 12 SP3

Novell Inc. Suse Linux Enterprise Server 12 SP4

Novell Inc. Suse Linux Enterprise Server 12 SP2-BCL

Novell Inc. Suse Linux Enterprise Server 12 SP2-ESPOS

Novell Inc. Suse Linux Enterprise Server 12 SP2-LTSS

Novell Inc. Suse Linux Enterprise Server 12 SP3-LTSS

Novell Inc. Suse Linux Enterprise Server 12 SP3-BCL

Novell Inc. Suse Linux Enterprise Server 12 SP3-ESPOS

Novell Inc. Suse Linux Enterprise Desktop 12 SP2

Novell Inc. Suse Linux Enterprise Server 15-LTSS

Novell Inc. Suse Linux Enterprise Desktop 11 SP4

Erich Boleyn Grub2 -

Novell Inc. Suse Linux Enterprise Server 11 SP2

Novell Inc. Suse Linux Enterprise Server 10 SP4 LTSS

Novell Inc. Suse Linux Enterprise Server 12 SP4-ESPOS

Novell Inc. Suse Linux Enterprise Server 12 SP4-LTSS

Novell Inc. Suse Linux Enterprise Server 15 SP1-BCL

Novell Inc. Suse Linux Enterprise Server 15 SP1-LTSS

Novell Inc. Suse Linux Enterprise Server 15 SP1

Сообщество свободного программного обеспечения Debian GNU/Linux 11

Сообщество свободного программного обеспечения Debian GNU/Linux 12

Novell Inc. Suse Linux Enterprise Server 15 SP3

Novell Inc. Suse Linux Enterprise Desktop 15 SP3

Novell Inc. Suse Linux Enterprise Server 15 SP2

Novell Inc. Suse Linux Enterprise Server 15 SP4

Novell Inc. Suse Linux Enterprise Desktop 15 SP2

Novell Inc. Suse Linux Enterprise Desktop 15 SP4

Novell Inc. Suse Linux Enterprise Server 15

Novell Inc. Suse Linux Enterprise Server 15 SP2-BCL

Red Hat Inc. Red Hat Enterprise Linux 9

Novell Inc. Suse Linux Enterprise Server 15 SP2-LTSS

Novell Inc. SUSE Linux Enterprise Real Time 15 SP2

Novell Inc. Suse Linux Enterprise Desktop 15 SP1

Novell Inc. Suse Linux Enterprise Desktop 15

Novell Inc. Suse Linux Enterprise Server 10 SP4

Novell Inc. openSUSE Leap Micro 5.2

Novell Inc. openSUSE Leap Micro 5.3

Novell Inc. SUSE Linux Enterprise Real Time 15 SP3

Novell Inc. Suse Linux Enterprise Server 15 SP3-BCL

Novell Inc. Suse Linux Enterprise Server 15 SP5

Novell Inc. Suse Linux Enterprise Desktop 15 SP5

Novell Inc. SUSE Linux Enterprise Real Time 15 SP4

Novell Inc. openSUSE Leap Micro 5.4

Novell Inc. openSUSE Leap Micro 5.5

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 4,6)

Средний уровень опасности (базовая оценка CVSS 3.1 составляет 4,4)

Возможные меры по устранению уязвимости

Компенсирующие меры:

- использование средств межсетевого экранирования для ограничения удалённого доступа к загрузчику GRUB;

- использование пароля для доступа к загрузчику GRUB в целях предотвращения попыток эксплуатации уязвимости;

- использование функционала мониторинга и журналирования для отслеживания попыток доступа к загрузчику GRUB.

Использование рекомендаций:

Для продуктов Novell Inc.:

https://www.suse.com/security/cve/CVE-2024-45783.html

Для Debian GNU/Linux:

https://security-tracker.debian.org/tracker/CVE-2024-45783

Для grub2:

https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html

https://www.openwall.com/lists/oss-security/2025/02/18/3

Для программных продуктов Red Hat Inc.:

https://access.redhat.com/security/cve/CVE-2024-45783

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Информация об устранении отсутствует

Ссылки на источники

Идентификаторы других систем описаний уязвимостей

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45783
CVE

EPSS

Процентиль: 11%

0.00041

Низкий

4.4 Medium

CVSS3

4.6 Medium

CVSS2

Связанные уязвимости

CVE-2024-45783

CVSS3: 4.4

ubuntu

6 месяцев назад

A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL pointer access.

CVE-2024-45783

CVSS3: 4.4

redhat

6 месяцев назад

A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL pointer access.

CVE-2024-45783

CVSS3: 4.4

nvd

6 месяцев назад

A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL pointer access.

CVE-2024-45783

CVSS3: 4.4

debian

6 месяцев назад

A flaw was found in grub2. When failing to mount an HFS+ grub, the hfs ...

GHSA-4wxw-3vrc-3hmh

CVSS3: 4.4

github

6 месяцев назад

A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL pointer access.

EPSS

Процентиль: 11%

0.00041

Низкий

4.4 Medium

CVSS3

4.6 Medium

CVSS2