SB2023033052 - SUSE update for grub2 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023033052

SB2023033052 - SUSE update for grub2

Published: March 30, 2023

Security Bulletin ID SB2023033052
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Physical access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Out-of-bounds write (CVE-ID: CVE-2022-2601)

The vulnerability allows an attacker to bypass implemented security restrictions.

The vulnerability exists due to a boundary error within the grub_font_construct_glyph() function when handling pf2 font. An attacker with physical access to the affected system can trigger an out-of-bounds write and bypass secure boot restrictions.


2) Out-of-bounds write (CVE-ID: CVE-2022-3775)

The vulnerability allows an attacker to crash the system.

The vulnerability exists due to a boundary error when rendering certain unicode sequences in grub2 font code. An attacker with physical access to device can trigger an out-of-bounds write and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References