CVE-2017-9763 — grub2: Stack exhaustion in grub_ext2_read_block

Back Back to CVE browser

HIGH

grub2: Stack exhaustion in grub_ext2_read_block

Published Jun 19, 2017

7.5

HIGH

CVSS 3.0

EPSS 4.19%

Description

The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote attackers to cause a denial of service (excessive stack use and application crash) via a crafted binary file, related to use of a variable-size stack array.

Affected products

Red Hat Enterprise Linux 5

grub

Not affected
Red Hat Enterprise Linux 6

grub

Not affected
Red Hat Enterprise Linux 7

grub2

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	grub	Not affected	n/a
Red Hat Enterprise Linux 6	grub	Not affected	n/a
Red Hat Enterprise Linux 7	grub2	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

4.19% 0.04188

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.04188

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (18 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	4.19% (0.04188)	90.62th	v5 (v2026.06.15)
Jun 15, 2026	4.15% (0.04153)	89.52th	v5 (v2026.06.15)
Mar 30, 2025	1.45% (0.01447)	78.96th	v4 (v2025.03.14)
Mar 29, 2025	4.12% (0.04118)	80.70th	v4 (v2025.03.14)
Mar 17, 2025	1.45% (0.01447)	79.42th	v4 (v2025.03.14)
Dec 12, 2024	0.50% (0.00504)	77.23th	v3 (v2023.03.01)
Feb 8, 2024	0.50% (0.00504)	75.77th	v3 (v2023.03.01)
May 8, 2023	0.50% (0.00504)	72.95th	v3 (v2023.03.01)
Apr 4, 2023	0.45% (0.00448)	71.16th	v3 (v2023.03.01)
Mar 7, 2023	0.47% (0.00473)	71.89th	v3 (v2023.03.01)
Mar 6, 2023	1.21% (0.01213)	66.61th	v2 (v2022.01.01)
Feb 17, 2023	1.21% (0.01213)	66.22th	v2 (v2022.01.01)
Apr 1, 2022	1.21% (0.01213)	64.21th	v2 (v2022.01.01)
Feb 4, 2022	1.21% (0.01213)	40.54th	v2 (v2022.01.01)
Feb 3, 2022	1.62% (0.01623)	33.90th	v1
Jan 6, 2022	1.62% (0.01623)	33.20th	v1
Sep 1, 2021	1.62% (0.01623)	73.32th	v1
Apr 14, 2021	1.62% (0.01623)	0.00th	v1

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-400

Uncontrolled Resource Consumption

References (8)

http://git.savannah.gnu.org/cgit/grub.git/commit/grub-core/fs/ext2.c?id=ac8cac1dac50daaf1c390d701cca3b55e16ee768
x_refsource_CONFIRMPatchThird Party Advisory
http://www.securityfocus.com/bid/99141
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-9763
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1463361
Issue Tracking
https://github.com/radare/radare2/commit/65000a7fd9eea62359e6d6714f17b94a99a82edd
x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/radare/radare2/issues/7723
x_refsource_CONFIRMPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-9763
https://www.cve.org/CVERecord?id=CVE-2017-9763

Link	Providers	Tags
http://git.savannah.gnu.org/cgit/grub.git/commit/grub-core/fs/ext2.c?id=ac8cac1dac50daaf1c390d701cca3b55e16ee768		x_refsource_CONFIRMPatchThird Party Advisory
http://www.securityfocus.com/bid/99141		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-9763		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1463361		Issue Tracking
https://github.com/radare/radare2/commit/65000a7fd9eea62359e6d6714f17b94a99a82edd		x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/radare/radare2/issues/7723		x_refsource_CONFIRMPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-9763
https://www.cve.org/CVERecord?id=CVE-2017-9763