CVE-2022-3775

2022-12-1920:15:11

CWE-787

[email protected]

web.nvd.nist.gov

506

cve-2022-3775

grub2

font code

vulnerability

memory corruption

nvd

security issue

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

8.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

When rendering certain unicode sequences, grub2’s font code doesn’t proper validate if the informed glyph’s width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2’s heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.

Affected configurations

Vulners

NVD

Node

gnugrub2Range≤2.06

VendorProductVersionCPE
gnugrub2*cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gnu	grub2	*	cpe:2.3:a:gnu:grub2::::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "grub2",
    "versions": [
      {
        "version": "All up to 2.06",
        "status": "affected"
      }
    ]
  }
]