CVE-2022-2601

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-2601
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0 Issue Tracking Third Party Advisory
https://security.gentoo.org/glsa/202311-14
https://security.netapp.com/advisory/ntap-20230203-0004/
https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-linux-users/
https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0 Issue Tracking Third Party Advisory
https://security.gentoo.org/glsa/202311-14
https://security.netapp.com/advisory/ntap-20230203-0004/
Configurations

Configuration 1 (hide)

cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*
History

21 Nov 2024, 07:01

Type Values Removed Values Added
References
  • () https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-linux-users/ -
References () https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0 - Issue Tracking, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0 - Issue Tracking, Third Party Advisory
References () https://security.gentoo.org/glsa/202311-14 - () https://security.gentoo.org/glsa/202311-14 -
References () https://security.netapp.com/advisory/ntap-20230203-0004/ - () https://security.netapp.com/advisory/ntap-20230203-0004/ -

25 Nov 2023, 12:15

Type Values Removed Values Added
CWE CWE-787
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20230203-0004/ -
  • () https://security.gentoo.org/glsa/202311-14 -

16 Dec 2022, 21:29

Type Values Removed Values Added
New CVE
Information

Published : 2022-12-14 21:15

Updated : 2024-11-21 07:01

NVD link : CVE-2022-2601

Mitre link : CVE-2022-2601

CVE.ORG link : CVE-2022-2601

JSON object : View

Products Affected

fedoraproject

  • fedora

redhat

  • enterprise_linux_server_aus
  • enterprise_linux_for_power_little_endian_eus
  • enterprise_linux_server_tus
  • enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
  • enterprise_linux_server_update_services_for_sap_solutions
  • enterprise_linux_eus

gnu

  • grub2
CWE
CWE-122

Heap-based Buffer Overflow