CVE-2022-28734 Out-of-bounds write when handling split HTTP headers

2023-07-2000:22:37

canonical

www.cve.org

cve-2022-28734

out-of-bounds write

http headers

grub2

attacker controlled packets

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

24.8%

JSON

Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NULL byte past the buffer. It’s conceivable that an attacker controlled set of packets can lead to corruption of the GRUB2’s internal memory metadata.

CNA Affected

[
  {
    "packageName": "grub2",
    "product": "GNU GRUB",
    "vendor": "GNU Project",
    "repo": "https://git.savannah.gnu.org/cgit/grub.git",
    "platforms": [
      "Linux"
    ],
    "versions": [
      {
        "lessThan": "2.06-3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]