CVE-2024-1048: Grub2: grub2-set-bootflag can be abused by local (pseudo-)users

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-06 · updated 2026-06-17
Weakness: CWE-459

Description

A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not be removed and may fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks.

Affected products

Fedoraproject Fedora: 40
grub2: all versions
Red Hat Enterprise Linux: 8.0, 9.0

References

https://access.redhat.com/errata/RHSA-2024:2456
https://access.redhat.com/errata/RHSA-2024:3184
https://access.redhat.com/security/cve/CVE-2024-1048
https://bugzilla.redhat.com/show_bug.cgi?id=2256827
https://www.openwall.com/lists/oss-security/2024/02/06/3
http://www.openwall.com/lists/oss-security/2024/02/06/3
https://access.redhat.com/errata/RHSA-2024:2456
https://access.redhat.com/errata/RHSA-2024:3184
https://access.redhat.com/security/cve/CVE-2024-1048
https://bugzilla.redhat.com/show_bug.cgi?id=2256827
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XRZQCVZ3XOASVFT6XLO7F2ZXOLOHIJZQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YSJAEGRR3XHMBBBKYOVMII4P34IXEYPE/

Get alerted when CVE-2024-1048 or the next vulnerability affects your stack