NewStart CGSL MAIN 7.02 : grub2 Multiple Vulnerabilities (NS-SA-2025-0082)

high Nessus Plugin ID 238000

Synopsis

The remote NewStart CGSL host is affected by multiple vulnerabilities.

Description

The remote NewStart CGSL host, running version MAIN 7.02, has grub2 packages installed that are affected by multiple vulnerabilities:

- A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the direct_read() will perform a heap based out-of-bounds write during data reading. This flaw may be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution, by-passing secure boot protections. (CVE-2025-0678)

- A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash. (CVE-2024-45778)

- An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an indirect extent map, grub2 fails to validate the number of extent entries to be read. A crafted or corrupted BFS filesystem may cause an integer overflow during the file reading, leading to a heap of bounds read. As a consequence, sensitive data may be leaked, or grub2 will crash. (CVE-2024-45779)

- A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer, impacting grub's sensitive data integrity and eventually leading to a secure boot protection bypass.
(CVE-2024-45782)

- GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem. (CVE-2024-56737)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the vulnerable CGSL grub2 packages. Note that updated packages may not be available yet. Please contact ZTE for more information.

Plugin Details

Severity: High

ID: 238000

File Name: newstart_cgsl_NS-SA-2025-0082_grub2.nasl

Version: 1.2

Type: local

Family: NewStart CGSL Local Security Checks

Published: 6/9/2025

Updated: 6/18/2025

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-0678

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:zte:cgsl_main:grub2-tools-efi, p-cpe:/a:zte:cgsl_main:grub2-efi-x64-modules, p-cpe:/a:zte:cgsl_main:grub2-pc, p-cpe:/a:zte:cgsl_main:grub2-tools-extra, p-cpe:/a:zte:cgsl_main:grub2-tools-minimal, cpe:/o:zte:cgsl_main:7, p-cpe:/a:zte:cgsl_main:grub2-pc-modules, p-cpe:/a:zte:cgsl_main:grub2-efi-x64, p-cpe:/a:zte:cgsl_main:grub2-common, p-cpe:/a:zte:cgsl_main:grub2-tools

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/ZTE-CGSL/release, Host/ZTE-CGSL/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 5/28/2025

Vulnerability Publication Date: 4/11/2024

Reference Information

CVE: CVE-2024-45778, CVE-2024-45779, CVE-2024-45782, CVE-2024-56737, CVE-2025-0678, CVE-2025-1125

Detections

Analytics