Vulnerability · Published Dec 14, 2022 · Assigned by redhat
CVE-2022-2601
High 8.6
In plain English
A high-severity heap buffer overflow in grub2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | grub2-common | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-common | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-efi-aa64 | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-efi-aa64 | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-efi-aa64-cdboot | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-efi-aa64-cdboot | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-efi-aa64-modules | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-efi-aa64-modules | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-efi-ia32 | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:8 | grub2-efi-ia32-cdboot | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:8 | grub2-efi-ia32-modules | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:8 | grub2-efi-x64 | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-efi-x64 | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-efi-x64-cdboot | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-efi-x64-cdboot | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-efi-x64-modules | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-efi-x64-modules | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-pc | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-pc | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-pc-modules | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-pc-modules | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-ppc64le | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-ppc64le | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-ppc64le-modules | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-ppc64le-modules | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-tools | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-tools | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-tools-efi | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-tools-efi | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-tools-extra | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-tools-extra | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| AlmaLinux:8 | grub2-tools-minimal | 1:2.02-142.el8_7.1.alma | ALSA-2023:0049 |
| AlmaLinux:9 | grub2-tools-minimal | 1:2.06-46.el9_1.3.alma | ALSA-2023:0752 |
| Debian:12 | grub2 | 2.06-5 | DEBIAN-CVE-2022-2601 |
| Debian:13 | grub2 | 2.06-5 | DEBIAN-CVE-2022-2601 |
| Debian:14 | grub2 | 2.06-5 | DEBIAN-CVE-2022-2601 |
| Rocky Linux:8 | grub2 | 1:2.02-142.el8_7.1.rocky.0.2 | RLSA-2023:0049 |
| Rocky Linux:9 | grub2 | 1:2.06-46.el9_1.3.rocky.0.2 | RLSA-2023:0752 |
| Ubuntu:22.04:LTS | grub2-signed | 1.187.3~22.04.1 | UBUNTU-CVE-2022-2601 |
| Ubuntu:22.04:LTS | grub2-unsigned | 2.06-2ubuntu14.1 | UBUNTU-CVE-2022-2601 |
Affected products (as reported)
Weakness: CWE-122, CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H