GRUB2 HFS Filesystem Heap-Based Out-of-Bounds Write Vulnerability Leading to Secure Boot Bypass

A heap-based out-of-bounds write vulnerability has been identified in the GRUB2 bootloader's HFS filesystem driver. This issue arises because the driver improperly validates the length of user-provided volume names before using them in a strcpy() operation. As a result, this flaw can corrupt memory, potentially allowing for the execution of arbitrary code. Furthermore, it jeopardizes the integrity of GRUB's sensitive data and could be exploited to bypass secure boot protections.

Impact

Exploitation of this vulnerability could lead to memory corruption, allowing for the modification of GRUB's sensitive data integrity. This memory corruption could be leveraged to execute unauthorized code, with the added consequence of bypassing secure boot protections.