Lucene search
HistoryDec 14, 2022 - 9:15 p.m.
CVE-2022-2601
8.6 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
26.4%
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.
Affected configurations
Node
gnugrub2Range≤2.06
Node
fedoraprojectfedoraMatch37
ORredhatenterprise_linux_eusMatch9.0
ORredhatenterprise_linux_for_power_little_endian_eusMatch9.0
ORredhatenterprise_linux_server_ausMatch8.2
ORredhatenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsMatch8.1
ORredhatenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsMatch8.2
ORredhatenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsMatch9.0
ORredhatenterprise_linux_server_tusMatch8.2
ORredhatenterprise_linux_server_update_services_for_sap_solutionsMatch8.1
ORredhatenterprise_linux_server_update_services_for_sap_solutionsMatch8.2
ORredhatenterprise_linux_server_update_services_for_sap_solutionsMatch9.0
Related
veracode
veracode
Buffer Overflow
2022-11-23 05:01:42
nessus
nessus
EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2023-1317)
2023-02-08 00:00:00
CentOS 7 : grub2 (RHSA-2024:2002)
2024-04-26 00:00:00
RHEL 7 : grub2 (RHSA-2024:2002)
2024-04-24 00:00:00
cve
cve
CVE-2022-2601
2022-12-14 21:15:10
debiancve
debiancve
CVE-2022-2601
2022-12-14 21:15:10
prion
prion
Heap overflow
2022-12-14 21:15:00
redhat
redhat
(RHSA-2024:2002) Moderate: grub2 security update
2024-04-23 15:15:30
(RHSA-2022:8978) Moderate: grub2 security and bug fix update
2022-12-13 15:31:13
(RHSA-2023:0752) Moderate: grub2 security update
2023-02-14 09:02:50
ubuntucve
ubuntucve
CVE-2022-2601
2022-12-14 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2022-0303
2022-12-21 00:00:00
Important Photon OS Security Update - PHSA-2022-0550
2022-12-21 00:00:00
Important Photon OS Security Update - PHSA-2022-4.0-0303
2022-12-21 00:00:00
cbl_mariner
cbl_mariner
CVE-2022-2601 affecting package grub2 2.06~rc1-8
2023-01-12 20:54:55
CVE-2022-2601 affecting package grub2 for versions less than 2.06-8
2023-01-17 16:46:47
CVE-2022-2601 affecting package grub2 for versions less than 2.06-14
2024-03-19 17:21:46
cvelist
cvelist
CVE-2022-2601
2022-12-14 00:00:00
redhatcve
redhatcve
CVE-2022-2601
2022-11-15 18:40:37
openvas
openvas
Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2023-1317)
2023-02-09 00:00:00
Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2023-1636)
2023-04-27 00:00:00
Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2023-1422)
2023-03-07 00:00:00
oraclelinux
oraclelinux
grub2 security update
2024-05-01 00:00:00
grub2 security update
2023-01-25 00:00:00
grub2 security update
2023-06-13 00:00:00
osv
osv
Moderate: grub2 security update
2023-02-16 06:35:52
Moderate: grub2 security update
2023-01-09 14:23:31
grub2 - security update
2022-11-16 00:00:00
fedora
fedora
[SECURITY] Fedora 37 Update: grub2-2.06-63.fc37
2022-11-18 01:18:26
[SECURITY] Fedora 36 Update: grub2-2.06-57.fc36
2022-11-27 01:37:59
[SECURITY] Fedora 35 Update: grub2-2.06-14.fc35
2022-12-01 01:39:11
debian
debian
[SECURITY] [DLA 3190-2] grub2 security update
2022-12-10 08:22:59
[SECURITY] [DLA 3190-1] grub2 security update
2022-11-16 09:12:12
[SECURITY] [DSA 5280-1] grub2 security update
2022-11-15 19:50:06
almalinux
almalinux
Moderate: grub2 security update
2023-02-14 00:00:00
Moderate: grub2 security update
2023-01-09 00:00:00
gentoo
gentoo
GRUB: Multiple Vulnerabilities
2023-11-25 00:00:00
rocky
rocky
grub2 security update
2023-02-16 06:35:52
grub2 security update
2023-01-09 14:23:31
rosalinux
rosalinux
Advisory ROSA-SA-2024-2348
2024-02-20 08:52:02
Advisory ROSA-SA-2024-2341
2024-02-14 10:25:29
ibm
ibm
redos
redos
ROS-20240403-05
2024-04-03 00:00:00
amazon
amazon
Important: grub2
2023-07-17 17:40:00
8.6 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
26.4%
Related for NVD:CVE-2022-2601