Remote Code Execution (RCE)

🗓️ 15 Jun 2022 16:10:50Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 27 Views

grub2 vulnerability remote code execution due to lack of sanitization in JPEG reade

Reporter	Title	Published	Views	Family All 161
Tenable Nessus	Amazon Linux 2022 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2022-2022-109)	7 Sep 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2023-020)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : grub2 (ALAS-2023-2146)	20 Jul 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0134: grub2, mokutil, shim, and shim-unsigned-x64 (ALINUX3-SA-2022:0134)	14 May 202500:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0164: grub2, mokutil, shim, and shim-unsigned-x64 (ALINUX3-SA-2022:0164)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : grub2, mokutil, shim, and shim-unsigned-x64 (ALSA-2022:5099)	16 Nov 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2022-2221)	17 Aug 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP10 : grub2 (EulerOS-SA-2022-2242)	17 Aug 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP10 : grub2 (EulerOS-SA-2022-2255)	17 Aug 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : grub2 (EulerOS-SA-2022-2289)	14 Sep 202200:00	–	nessus

Vulners

Node

gnu grub2Match2.04-10debian

AND

debian debian_linuxMatch999

OR

gnu grub2Match2.02+dfsg1-20+deb10u3debian

AND

gnu grub2Match2.02+dfsg1-20+deb10u4debian

AND

gnu grub2Match2.02+dfsg1-20+deb10u2debian

AND

debian debian_linuxMatch10

OR

gnu grub2Match2.04-10debian

AND

debian debian_linuxMatch11

OR

devel develMatch2.04-1ubuntu34debian

AND

devel develMatch2.04-1ubuntu44debian

AND

devel develMatch2.04-1ubuntu30debian

AND

devel develMatch2.04-1ubuntu36debian

AND

devel develMatch2.04-1ubuntu28debian

AND

debian debian_linux

OR

gnu grubMatch2.06-r2os

AND

gnu grubMatch2.04-r3os

AND

gnu grubMatch2.06-r9os

AND

gnu grubMatch2.06-r6os

AND

gnu grubMatch2.06-r10os

AND

gnu grubMatch2.04-r1os

AND

gnu grubMatch2.06-r7os

AND

gnu grubMatch2.06-r1os

AND

gnu grubMatch2.06-r12os

AND

gnu grubMatch2.06-r4os

AND

gnu grubMatch2.06-r11os

AND

gnu grubMatch2.04-r0os

AND

gnu grubMatch2.06-r0os

AND

gnu grubMatch2.06-r5os

AND

gnu grubMatch2.06-r8os

AND

gnu grubMatch2.04-r2os

AND

alpinelinux alpine_linuxMatchedge

OR

gnu grubMatch2.06-r7os

AND

gnu grubMatch2.06-r6os

AND

alpinelinux alpine_linuxMatch3.17

OR

gnu grubMatch2.06-r11os

AND

alpinelinux alpine_linuxMatch3.18

OR

gnu grubMatch2.06-r1os

AND

gnu grubMatch2.06-r2os

AND

alpinelinux alpine_linuxMatch3.15

OR

gnu grubMatch2.06-r2os

AND

alpinelinux alpine_linuxMatch3.16

OR

gnu grub2Match2.02_0.17.ael7b_1.2

OR

gnu grub2Match2.02_0.81.el7.centos

OR

gnu grub2Match2.02_0.65.el7.centos.2

OR

gnu grub2Match2.02_0.86.el7.centos

OR

gnu grub2Match2.02_0.87.0.1.el7.centos.9

OR

gnu grub2Match2.02_0.87.el7.centos.6

OR

gnu grub2Match2.02_0.87.el7.9

OR

gnu grub2Match2.02_0.76.el7.centos

OR

gnu grub2Match2.02_0.87.el7.centos.2

OR

gnu grub2Match2.02_0.76.el7.centos.1

OR

gnu grub2Match2.02_0.87.el7.centos

OR

gnu grub2Match2.02_0.87.el7.centos.7

OR

gnu grub2Match2.02_0.80.el7.centos

Source	Link
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-3697
security	www.security.gentoo.org/glsa/202209-12
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
security	www.security.netapp.com/advisory/ntap-20220930-0001/

14 Sep 2023 14:39Current

7.3High risk

Vulners AI Score7.3

CVSS 24.4

CVSS 3.17

EPSS0.00067

grub2 vulnerability remote code execution sanitization jpeg reader malicious script crafted image software