GRUB2 (HFS filesystem parser): An unbounded strcpy of the HFS volume name overflows a fixed buffer

Impact

An unbounded strcpy of the HFS volume name overflows a fixed buffer. About as direct a memory-corruption primitive as this codebase contains, and it fires on nothing more than attaching a crafted volume.

Who can reach it

Attacker-supplied HFS volume, including one presented over BMC virtual media.

What to do

grub2 package update + reboot. Strip the HFS module if you never boot Apple-formatted media, which on a GPU fleet is always.

References