Description
A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not be removed and may fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks.
Affected products
gnu: grub2; redhat: enterprise linux; fedoraproject: fedora
References10
- access.redhat.com/security/cve/CVE-2024-1048 Vendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2256827 Issue TrackingVendor Advisory
- access.redhat.com/security/cve/CVE-2024-1048 Vendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2256827 Issue TrackingVendor Advisory
- access.redhat.com/errata/RHSA-2024:2456
- access.redhat.com/errata/RHSA-2024:3184
- www.openwall.com/lists/oss-security/2024/02/06/3 Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2024/02/06/3
- access.redhat.com/errata/RHSA-2024:2456
- access.redhat.com/errata/RHSA-2024:3184
Metrics
- CVSS 3.1
-
3.3
LOW
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - EPSS — exploit probability
- 0% percentile: 19 · as of 5 November 2026
- CWE
- CWE-459
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.