CVE-2024-45783 Grub2: fs/hfs+: refcount can be decremented twice
A flaw in the GRUB2 HFS+ driver causes a NULL pointer dereference during mount failures, potentially leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45783?
CVE-2024-45783 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 18 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL pointer access.
Weakness: CWE-911
Which versions are affected by CVE-2024-45783?
How do I fix CVE-2024-45783?
Apply the vendor's patch.
Is CVE-2024-45783 being exploited?
There is no known exploitation of CVE-2024-45783 in the wild and no public exploit code.
Sources
Also known as AZL-56954, AZL-56983, BELL-CVE-2024-45783, DEBIAN-CVE-2024-45783, GHSA-4wxw-3vrc-3hmh, UBUNTU-CVE-2024-45783.