Lucene search
HistoryDec 14, 2022 - 9:15 p.m.
CVE-2022-2601
buffer overflow
grub_font_construct_glyph
pf2 font
heap based out-of-bounds write
secure boot mechanism
8.6 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
26.6%
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.
Affected configurations
Node
gnugrub2Range≤2.06
Node
fedoraprojectfedoraMatch37
ORredhatenterprise_linux_eusMatch9.0
ORredhatenterprise_linux_for_power_little_endian_eusMatch9.0
ORredhatenterprise_linux_server_ausMatch8.2
ORredhatenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsMatch8.1
ORredhatenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsMatch8.2
ORredhatenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsMatch9.0
ORredhatenterprise_linux_server_tusMatch8.2
ORredhatenterprise_linux_server_update_services_for_sap_solutionsMatch8.1
ORredhatenterprise_linux_server_update_services_for_sap_solutionsMatch8.2
ORredhatenterprise_linux_server_update_services_for_sap_solutionsMatch9.0
Related
nessus
nessus
CentOS 7 : grub2 (RHSA-2024:2002)
2024-04-26 00:00:00
EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2023-1317)
2023-02-08 00:00:00
Oracle Linux 7 : grub2 (ELSA-2024-2002)
2024-05-03 00:00:00
veracode
veracode
Buffer Overflow
2022-11-23 05:01:42
cbl_mariner
cbl_mariner
CVE-2022-2601 affecting package grub2 for versions less than 2.06-8
2023-01-17 16:46:47
CVE-2022-2601 affecting package grub2 2.06~rc1-8
2023-01-12 20:54:55
CVE-2022-2601 affecting package grub2 for versions less than 2.06-14
2024-03-19 17:21:46
cvelist
cvelist
CVE-2022-2601
2022-12-14 00:00:00
ubuntucve
ubuntucve
CVE-2022-2601
2022-12-14 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2022-0303
2022-12-21 00:00:00
Important Photon OS Security Update - PHSA-2022-0550
2022-12-21 00:00:00
Important Photon OS Security Update - PHSA-2022-4.0-0303
2022-12-21 00:00:00
cve
cve
CVE-2022-2601
2022-12-14 21:15:10
prion
prion
Heap overflow
2022-12-14 21:15:00
redhat
redhat
(RHSA-2024:2002) Moderate: grub2 security update
2024-04-23 15:15:30
(RHSA-2023:0752) Moderate: grub2 security update
2023-02-14 09:02:50
(RHSA-2022:8978) Moderate: grub2 security and bug fix update
2022-12-13 15:31:13
debiancve
debiancve
CVE-2022-2601
2022-12-14 21:15:10
oraclelinux
oraclelinux
grub2 security update
2024-05-01 00:00:00
grub2 security update
2023-01-12 00:00:00
grub2 security update
2023-06-13 00:00:00
redhatcve
redhatcve
CVE-2022-2601
2022-11-15 18:40:37
openvas
openvas
Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2023-1317)
2023-02-09 00:00:00
Fedora: Security Advisory for grub2 (FEDORA-2022-f86e203baf)
2022-11-27 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:4144-1)
2022-11-22 00:00:00
osv
osv
Moderate: grub2 security update
2023-02-16 06:35:52
Moderate: grub2 security update
2023-01-09 14:23:31
grub2 - security update
2022-11-16 00:00:00
debian
debian
[SECURITY] [DLA 3190-1] grub2 security update
2022-11-16 09:12:12
[SECURITY] [DSA 5280-1] grub2 security update
2022-11-15 19:50:06
[SECURITY] [DLA 3190-2] grub2 security update
2022-12-10 08:22:59
ibm
ibm
fedora
fedora
[SECURITY] Fedora 35 Update: grub2-2.06-14.fc35
2022-12-01 01:39:11
[SECURITY] Fedora 36 Update: grub2-2.06-57.fc36
2022-11-27 01:37:59
[SECURITY] Fedora 37 Update: grub2-2.06-63.fc37
2022-11-18 01:18:26
rocky
rocky
grub2 security update
2023-01-09 14:23:31
grub2 security update
2023-02-16 06:35:52
redos
redos
ROS-20240403-05
2024-04-03 00:00:00
almalinux
almalinux
Moderate: grub2 security update
2023-01-09 00:00:00
Moderate: grub2 security update
2023-02-14 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2024-2348
2024-02-20 08:52:02
Advisory ROSA-SA-2024-2341
2024-02-14 10:25:29
gentoo
gentoo
GRUB: Multiple Vulnerabilities
2023-11-25 00:00:00
amazon
amazon
Important: grub2
2023-07-17 17:40:00
8.6 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
26.6%
Related for NVD:CVE-2022-2601