The vulnerability of the Grub2 operating system loader, related to writing beyond the boundary during the processing of split HTTP headers, allows a hacker to cause a service failure.

🗓️ 13 Feb 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Grub boot loader flaw out-of-bounds writes in split HTTP header processing enables remote disruption.

Reporter	Title	Published	Views	Family All 174
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been fixed in IBM Security Verify Governance, Identity Manager virtual appliance component	20 Dec 202220:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Access Appliance includes components with known vulnerabilities	12 Jan 202323:10	–	ibm
Tenable Nessus	Amazon Linux 2022 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2022-2022-109)	7 Sep 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2023-020)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : grub2 (ALAS-2023-2146)	20 Jul 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0134: grub2, mokutil, shim, and shim-unsigned-x64 (ALINUX3-SA-2022:0134)	14 May 202500:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0164: grub2, mokutil, shim, and shim-unsigned-x64 (ALINUX3-SA-2022:0164)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : grub2, mokutil, shim, and shim-unsigned-x64 (ALSA-2022:5099)	16 Nov 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2022-2221)	17 Aug 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP10 : grub2 (EulerOS-SA-2022-2242)	17 Aug 202200:00	–	nessus

Vulners

Node

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

OR

red_hat red_hat_enterprise_linuxMatch9

OR

erich_boleyn grub2Range2.00–2.06-3

Source	Link
git	www.git.savannah.gnu.org/gitweb/
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
access	www.access.redhat.com/security/cve/CVE-2022-28734
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.6/
abf	www.abf.rosalinux.ru/advisories/ROSA-SA-2024-2349
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16
web	www.web.nvd.nist.gov/view/vuln/detail

30 Sep 2024 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 26.6

CVSS 37

EPSS0.00151

Grub boot loader out of bounds split web headers remote disruption