An integer overflow flaw exists in the BFS file system driver within grub2. Specifically, when grub2 reads a file that uses an indirect extent map, it does not validate the count of extent entries to be read. A crafted or corrupted BFS filesystem can trigger an integer overflow during this process, resulting in a heap out-of-bounds read. The consequences include possible leakage of sensitive data or a denial-of-service crash of grub2. The vulnerability has a CVSS 3.1 base score of 6.0, indicating medium severity, with local attack vector, low complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation can cause grub2 to read beyond heap boundaries, potentially leaking sensitive information from memory or causing the grub2 process to crash, leading to denial of service. The attack requires local access with high privileges and does not affect integrity but impacts confidentiality and availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2024-45779 for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, avoid using grub2 with BFS filesystems from untrusted sources and restrict local privileged access to trusted users only.