CVEvulnerability

CVE-2022-2601

8.6 HIGH Published 2022-12-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-12-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.6 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-122, CWE-787

Description

A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.

Affected configurations

• gnu grub2 (<= 2.06) • fedoraproject fedora 37 • redhat enterprise linux eus 9.0 • redhat enterprise linux for power little endian eus 9.0 • redhat enterprise linux server aus 8.2 • redhat enterprise linux server for power little endian update services for sap solutions 8.1 • redhat enterprise linux server for power little endian update services for sap solutions 8.2 • redhat enterprise linux server for power little endian update services for sap solutions 9.0 • redhat enterprise linux server tus 8.2 • redhat enterprise linux server update services for sap solutions 8.1 • redhat enterprise linux server update services for sap solutions 8.2 • redhat enterprise linux server update services for sap solutions 9.0

Related

Weakness · CWE (2)

  • CWE-122 Heap-based Buffer Overflow weakness
  • CWE-787 Out-of-bounds Write weakness

References