CVE-2022-2601 — Heap-based Buffer Overflow in Grub2
Severity
8.6HIGHNVD
GHSA5.4
EPSS
0.1%
top 79.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 14
Latest updateMay 14
Description
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HExploitability: 1.8 | Impact: 6.0
🔴Vulnerability Details
10📋Vendor Advisories
5Microsoft▶
Redhat: CVE-2022-2601 grub2 - Buffer overflow in grub_font_construct_glyph() can lead to out-of-bound write and possible secure boot bypass↗2024-08-13
Microsoft▶
CVE-2022-2601: FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One↗2022-12-13
Red Hat▶
grub2: Buffer overflow in grub_font_construct_glyph() can lead to out-of-bound write and possible secure boot bypass↗2022-11-15
Debian▶
CVE-2022-2601: grub2 - A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted ...↗2022