From 2495630383c4a6659b6b91a58e4f71cdda283f2f Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Wed, 21 Aug 2024 15:09:49 +0200 Subject: [PATCH] boot/grub2: ignore CVE-2024-1048 As explained in: https://security-tracker.debian.org/tracker/CVE-2024-1048 https://www.openwall.com/lists/oss-security/2024/02/06/3 CVE-2024-1048 is related to a tool called grub-set-bootflag which only exists in the Redhat fork of Grub, and which we don't use in Buildroot, so this CVE should be ignored. Signed-off-by: Thomas Petazzoni --- boot/grub2/grub2.mk | 3 +++ 1 file changed, 3 insertions(+) diff --git a/boot/grub2/grub2.mk b/boot/grub2/grub2.mk index 6d0d71c47d..19544b6e12 100644 --- a/boot/grub2/grub2.mk +++ b/boot/grub2/grub2.mk @@ -25,6 +25,9 @@ GRUB2_IGNORE_CVES += CVE-2019-14865 GRUB2_IGNORE_CVES += CVE-2020-15705 # vulnerability is specific to the SUSE distribution GRUB2_IGNORE_CVES += CVE-2021-46705 +# vulnerability is specific to the Redhat distribution, affects the +# grub2-set-bootflag tool, which doesn't exist upstream +GRUB2_IGNORE_CVES += CVE-2024-1048 ifeq ($(BR2_TARGET_GRUB2_INSTALL_TOOLS),y) GRUB2_INSTALL_TARGET = YES