Lucene search

K
cvelistCanonicalCVELIST:CVE-2022-28735
HistoryJul 20, 2023 - 12:22 a.m.

CVE-2022-28735

2023-07-2000:22:51
canonical
www.cve.org
grub2
shim_lock
non-kernel files
secure boot
unverified code

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

The GRUB2’s shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules to be loaded in GRUB2 breaking the secure boot trust-chain.

CNA Affected

[
  {
    "packageName": "grub2",
    "product": "GNU GRUB",
    "vendor": "GNU Project",
    "repo": "https://git.savannah.gnu.org/cgit/grub.git",
    "platforms": [
      "Linux"
    ],
    "versions": [
      {
        "lessThan": "2.06-3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%