GRUB2 (gettext / message catalogue): Integer overflow reading a crafted translation catalogue gives both

Impact

Integer overflow reading a crafted translation catalogue gives both an out-of-bounds read and write. Language files are unsigned data on the boot partition, which makes them an easy carrier for a bootkit on a node an attacker has held once.

Who can reach it

Attacker-supplied .mo file in GRUB's locale directory - local root or previous tenant.

What to do

grub2 package update + reboot. Removing locale files from a server image is a cheap surface reduction.

References