GRUB2 (tar filesystem parser): Integer overflow in the tarfs module writes out of bounds

Impact

Integer overflow in the tarfs module writes out of bounds. Tar archives are a normal part of initrd and provisioning workflows, so this is more reachable in practice than the exotic filesystem parsers.

Who can reach it

Attacker-supplied tar image parsed by GRUB during boot.

What to do

grub2 package update + reboot.

References