Information disclosure in grub - CVE-2024-49504

Vulnerability identifier: #VU104090

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-49504

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to an error in grub implementation. A local user with access to the grub shell can access files on the encrypted disks.

grub
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Basesystem Module
Server Applications Module
openSUSE Leap
openEuler
SmartFabric Manager
APEX Cloud Platform for Microsoft Azure
grub2-efi-aa64-modules
grub2
grub2-debuginfo
grub2-debugsource
grub2-efi-aa64
grub2-efi-aa64-cdboot
grub2-tools
grub2-tools-extra
grub2-tools-minimal
grub2-common
grub2-efi-ia32-modules
grub2-efi-x64-modules
grub2-help
grub2-pc-modules
grub2-efi-ia32
grub2-efi-ia32-cdboot
grub2-efi-x64
grub2-efi-x64-cdboot
grub2-pc
grub2-tools-efi
grub2-powerpc-ieee1275-extras
grub2-s390x-emu-debug
grub2-i386-xen-extras
grub2-i386-efi
grub2-x86_64-xen-debug
grub2-powerpc-ieee1275
grub2-systemd-sleep-plugin
grub2-x86_64-efi
grub2-snapper-plugin
grub2-i386-pc
grub2-arm64-efi
grub2-s390x-emu
grub2-x86_64-xen
grub2-branding-upstream
grub2-x86_64-efi-extras
grub2-i386-pc-extras
grub2-i386-efi-extras
grub2-i386-pc-debug
grub2-i386-efi-debug
grub2-s390x-emu-extras
grub2-i386-xen-debug
grub2-powerpc-ieee1275-debug
grub2-arm64-efi-debug
grub2-i386-xen
grub2-arm64-efi-extras
grub2-x86_64-efi-debug
grub2-x86_64-xen-extras
APEX Cloud Platform for Red Hat OpenShift

Install updates from vendor's website.

SmartFabric Manager - update to 1.3.0
APEX Cloud Platform for Microsoft Azure - update to 01.04.01.00
grub2-efi-aa64-modules - update to 2.04-41
grub2 - update to 2.04-41
grub2-debuginfo - update to 2.04-41
grub2-debugsource - update to 2.04-41
grub2-efi-aa64 - update to 2.04-41
grub2-efi-aa64-cdboot - update to 2.04-41
grub2-tools - update to 2.04-41
grub2-tools-extra - update to 2.04-41
grub2-tools-minimal - update to 2.04-41
grub2-common - update to 2.04-41
grub2-efi-ia32-modules - update to 2.04-41
grub2-efi-x64-modules - update to 2.04-41
grub2-help - update to 2.04-41
grub2-pc-modules - update to 2.04-41
grub2-efi-ia32 - update to 2.04-41
grub2-efi-ia32-cdboot - update to 2.04-41
grub2-efi-x64 - update to 2.04-41
grub2-efi-x64-cdboot - update to 2.04-41
grub2-pc - update to 2.04-41
grub2-tools-efi - update to 2.04-41
grub2-powerpc-ieee1275-extras - update to 2.12-150600.8.18.2
grub2-s390x-emu-debug - update to 2.12-150600.8.18.2
grub2-i386-xen-extras - update to 2.12-150600.8.18.2
grub2-i386-efi - update to 2.12-150600.8.18.2
grub2-x86_64-xen-debug - update to 2.12-150600.8.18.2
grub2 - update to 2.12-150600.8.18.2
grub2-powerpc-ieee1275 - update to 2.12-150600.8.18.2
grub2-systemd-sleep-plugin - update to 2.12-150600.8.18.2
grub2-x86_64-efi - update to 2.12-150600.8.18.2
grub2-snapper-plugin - update to 2.12-150600.8.18.2
grub2-i386-pc - update to 2.12-150600.8.18.2
grub2-arm64-efi - update to 2.12-150600.8.18.2
grub2-debugsource - update to 2.12-150600.8.18.2
grub2-s390x-emu - update to 2.12-150600.8.18.2
grub2-x86_64-xen - update to 2.12-150600.8.18.2
grub2-branding-upstream - update to 2.12-150600.8.18.2
grub2-x86_64-efi-extras - update to 2.12-150600.8.18.2
grub2-i386-pc-extras - update to 2.12-150600.8.18.2
grub2-debuginfo - update to 2.12-150600.8.18.2
grub2-i386-efi-extras - update to 2.12-150600.8.18.2
grub2-i386-pc-debug - update to 2.12-150600.8.18.2
grub2-i386-efi-debug - update to 2.12-150600.8.18.2
grub2-s390x-emu-extras - update to 2.12-150600.8.18.2
grub2-i386-xen-debug - update to 2.12-150600.8.18.2
grub2-powerpc-ieee1275-debug - update to 2.12-150600.8.18.2
grub2-arm64-efi-debug - update to 2.12-150600.8.18.2
grub2-i386-xen - update to 2.12-150600.8.18.2
grub2-arm64-efi-extras - update to 2.12-150600.8.18.2
grub2-x86_64-efi-debug - update to 2.12-150600.8.18.2
grub2-x86_64-xen-extras - update to 2.12-150600.8.18.2
APEX Cloud Platform for Red Hat OpenShift - update to 03.02.04.00

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-49504

• Multiple vulnerabilities in GRUB2
• SUSE update for grub2
• Dell APEX Cloud Platform for Red Hat OpenShift update for third-party components
• openEuler update for grub2
• Dell APEX Cloud Platform for Microsoft Azure update for third-party components
• Dell SmartFabric Manager update for third-party components