Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-ff72-fwj3-6gh6

Опубликовано: 20 июл. 2023
Источник: github
Github: Не прошло ревью
CVSS3: 6.4

Описание

There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved.

There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved.

EPSS

Процентиль: 7%
0.00029
Низкий

6.4 Medium

CVSS3

Дефекты

CWE-416

Связанные уязвимости

CVSS3: 6.4
ubuntu
почти 2 года назад

There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved.

CVSS3: 7
redhat
около 3 лет назад

There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved.

CVSS3: 6.4
nvd
почти 2 года назад

There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved.

CVSS3: 7.8
msrc
почти 2 года назад

Описание отсутствует

CVSS3: 6.4
debian
почти 2 года назад

There's a use-after-free vulnerability in grub_cmd_chainloader() funct ...

EPSS

Процентиль: 7%
0.00029
Низкий

6.4 Medium

CVSS3

Дефекты

CWE-416