Vulnerability · Published Jul 20, 2023 · Assigned by canonical
CVE-2022-28735
Medium 6.7
In plain English
A medium-severity security flaw in GNU GRUB from GNU Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.7Medium
Exploit odds (30 days)0.3%top 75.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules to be loaded in GRUB2 breaking the secure boot trust-chain.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | grub2-common | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-common | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-efi-aa64 | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-efi-aa64 | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-efi-aa64-cdboot | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-efi-aa64-cdboot | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-efi-aa64-modules | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-efi-aa64-modules | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-efi-ia32 | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:8 | grub2-efi-ia32-cdboot | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:8 | grub2-efi-ia32-modules | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:8 | grub2-efi-x64 | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-efi-x64 | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-efi-x64-cdboot | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-efi-x64-cdboot | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-efi-x64-modules | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-efi-x64-modules | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-pc | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-pc | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-pc-modules | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-pc-modules | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:9 | grub2-ppc64le | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-ppc64le-modules | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-ppc64le-modules | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-tools | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-tools | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-tools-efi | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-tools-efi | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-tools-extra | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-tools-extra | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-tools-minimal | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-tools-minimal | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | shim-aa64 | 15.6-1.el8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | shim-aa64 | 15.6-1.el9.alma | ALSA-2022:5099 |
| AlmaLinux:8 | shim-ia32 | 15.6-1.el8.alma | ALSA-2022:5095 |
| AlmaLinux:8 | shim-unsigned-x64 | 15.6-1.el8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | shim-unsigned-x64 | 15.6-1.el9.alma | ALSA-2022:5099 |
| AlmaLinux:8 | shim-x64 | 15.6-1.el8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | shim-x64 | 15.6-1.el9.alma | ALSA-2022:5099 |
| Debian:12 | grub2 | 2.06-3 | DEBIAN-CVE-2022-28735 |
| Debian:13 | grub2 | 2.06-3 | DEBIAN-CVE-2022-28735 |
| Debian:14 | grub2 | 2.06-3 | DEBIAN-CVE-2022-28735 |
| Rocky Linux:8 | grub2 | 1:2.02-123.el8_6.8 | RLSA-2022:5095 |
| Rocky Linux:8 | mokutil | 1:0.3.0-11.el8_6.1 | RLSA-2022:5095 |
| Rocky Linux:9 | mokutil | 2:0.4.0-8.el9_0.1 | RLSA-2022:5099 |
| Rocky Linux:8 | shim | 0:15.6-1.el8 | RLSA-2022:5095 |
| Rocky Linux:9 | shim | 0:15.6-1.el9 | RLSA-2022:5099 |
| Rocky Linux:9 | shim | 0:15.6-1.el9.rocky.0.1 | RLSA-2022:5099 |
| Rocky Linux:8 | shim-unsigned-x64 | 0:15.6-1.el8 | RLSA-2022:5095 |
| Ubuntu:22.04:LTS | grub2-signed | 1.187.3~22.04.1 | USN-6355-1 |
| Ubuntu:22.04:LTS | grub2-signed | 1.187.3~22.04.1 | UBUNTU-CVE-2022-28735 |
| Ubuntu:22.04:LTS | grub2-unsigned | 2.06-2ubuntu14.1 | UBUNTU-CVE-2022-28735 |
| Ubuntu:22.04:LTS | grub2-unsigned | 2.06-2ubuntu14.1 | USN-6355-1 |
| Ubuntu:22.04:LTS | shim | 15.7-0ubuntu1 | USN-6355-1 |
| Ubuntu:22.04:LTS | shim-signed | 1.51.3 | USN-6355-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GNU Project | GNU GRUB | 0 – before 2.06-3 |