CVE-2024-1048

What it actually does

The grub2-set-bootflag utility creates a temporary file with updated grubenv content and renames it, but leaves the temporary file behind if killed before the rename, allowing repeated invocations to exhaust filesystem inodes or blocks.

Why it matters to the business

Accumulation of orphaned temporary files can render affected systems unbootable or unusable by depleting storage resources, leading to operational downtime for systems relying on GRUB2.

How an attack unfolds

A local attacker repeatedly runs the utility and terminates it before the rename completes, causing temporary files to accumulate until the filesystem has no free inodes or blocks.

How to fix it

Upgrade GRUB2 to a version that ensures temporary files are cleaned up on interruption; monitor and manually remove orphaned temporary files in the GRUB environment directory until patched.

How to confirm the fix worked

Confirm that invocations of grub2-set-bootflag under interruption no longer leave behind temporary files and that filesystem free space remains stable.

Typical attack path

1. Obtain local user access on an affected system
2. Repeatedly invoke grub2-set-bootflag
3. Kill the process before the rename operation completes
4. Repeat until filesystem resources are exhausted

How to detect it

Inspect system logs and GRUB directories for repeated creation of temporary grubenv files without corresponding renames or cleanup, and monitor for abnormal termination of the utility.

• /boot/grub2/grubenv.tmp
• grub2-set-bootflag.*killed
• excessive temporary files in /boot/grub2

What your security team should do

• Prioritize patching GRUB2 packages in all affected distributions
• Add filesystem monitoring for temporary file accumulation in GRUB directories
• Restrict execution permissions on grub2-set-bootflag where possible