high8.6
CVE-2022-2601
A buffer overflow was found in grub_font_construct_glyph().
Impact
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gnu | Grub2 | through 2.06 |
| Fedoraproject | Fedora | Version 37 |
| Redhat | Enterprise Linux Eus | Version 9.0 |
| Redhat | Enterprise Linux For Power Little Endian Eus | Version 9.0 |
| Redhat | Enterprise Linux Server Aus | Version 8.2 |
| Redhat | Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions | Versions 8.1, 8.2, 9.0 |
| Redhat | Enterprise Linux Server Tus | Version 8.2 |
| Redhat | Enterprise Linux Server Update Services For Sap Solutions | Versions 8.1, 8.2, 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0
- https://security.gentoo.org/glsa/202311-14
- https://security.netapp.com/advisory/ntap-20230203-0004/
- https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-linux-users/
- https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0
- https://security.gentoo.org/glsa/202311-14
- https://security.netapp.com/advisory/ntap-20230203-0004/