Homepage

Incomplete Cleanup The advisory has been revoked - it doesn't affect any version of package grub2-efi-x64-cdboot  (opens in a new tab)

Threat Intelligence

EPSS
0.27% (19th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-GRUB2EFIX64CDBOOT-12418916
  • published1 Sept 2025
  • disclosed6 Feb 2024
Report a new vulnerability Found a mistake?

Introduced: 6 Feb 2024

CVE-2024-1048  (opens in a new tab)
CWE-459  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream grub2-efi-x64-cdboot package and not the grub2-efi-x64-cdboot package as distributed by RHEL.

A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not be removed and may fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks.