Vulnerability · Published Jul 20, 2023 · Assigned by canonical
CVE-2022-28736There's a use-after-free vulnerability in grub_cmd_chainloader() function
Medium 6.4
In plain English
A medium-severity security flaw in GNU GRUB from GNU Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.3%top 78.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | grub2-common | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-common | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-efi-aa64 | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-efi-aa64 | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-efi-aa64-cdboot | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-efi-aa64-cdboot | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-efi-aa64-modules | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-efi-aa64-modules | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-efi-ia32 | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:8 | grub2-efi-ia32-cdboot | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:8 | grub2-efi-ia32-modules | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:8 | grub2-efi-x64 | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-efi-x64 | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-efi-x64-cdboot | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-efi-x64-cdboot | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-efi-x64-modules | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-efi-x64-modules | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-pc | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-pc | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-pc-modules | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-pc-modules | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:9 | grub2-ppc64le | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-ppc64le-modules | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-ppc64le-modules | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-tools | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-tools | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-tools-efi | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-tools-efi | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-tools-extra | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-tools-extra | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | grub2-tools-minimal | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | grub2-tools-minimal | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux:8 | shim-aa64 | 15.6-1.el8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | shim-aa64 | 15.6-1.el9.alma | ALSA-2022:5099 |
| AlmaLinux:8 | shim-ia32 | 15.6-1.el8.alma | ALSA-2022:5095 |
| AlmaLinux:8 | shim-unsigned-x64 | 15.6-1.el8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | shim-unsigned-x64 | 15.6-1.el9.alma | ALSA-2022:5099 |
| AlmaLinux:8 | shim-x64 | 15.6-1.el8.alma | ALSA-2022:5095 |
| AlmaLinux:9 | shim-x64 | 15.6-1.el9.alma | ALSA-2022:5099 |
| Debian:12 | grub2 | 2.06-3 | DEBIAN-CVE-2022-28736 |
| Debian:13 | grub2 | 2.06-3 | DEBIAN-CVE-2022-28736 |
| Debian:14 | grub2 | 2.06-3 | DEBIAN-CVE-2022-28736 |
| Rocky Linux:8 | grub2 | 1:2.02-123.el8_6.8 | RLSA-2022:5095 |
| Rocky Linux:8 | mokutil | 1:0.3.0-11.el8_6.1 | RLSA-2022:5095 |
| Rocky Linux:9 | mokutil | 2:0.4.0-8.el9_0.1 | RLSA-2022:5099 |
| Rocky Linux:8 | shim | 0:15.6-1.el8 | RLSA-2022:5095 |
| Rocky Linux:9 | shim | 0:15.6-1.el9 | RLSA-2022:5099 |
| Rocky Linux:9 | shim | 0:15.6-1.el9.rocky.0.1 | RLSA-2022:5099 |
| Rocky Linux:8 | shim-unsigned-x64 | 0:15.6-1.el8 | RLSA-2022:5095 |
| Ubuntu:22.04:LTS | grub2-signed | 1.187.3~22.04.1 | USN-6355-1 |
| Ubuntu:22.04:LTS | grub2-signed | 1.187.3~22.04.1 | UBUNTU-CVE-2022-28736 |
| Ubuntu:22.04:LTS | grub2-unsigned | 2.06-2ubuntu14.1 | UBUNTU-CVE-2022-28736 |
| Ubuntu:22.04:LTS | grub2-unsigned | 2.06-2ubuntu14.1 | USN-6355-1 |
| Ubuntu:22.04:LTS | shim | 15.7-0ubuntu1 | USN-6355-1 |
| Ubuntu:22.04:LTS | shim-signed | 1.51.3 | USN-6355-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GNU Project | GNU GRUB | 0 – before 2.06-3 |