Out-of-bounds write in grub - CVE-2022-2601

Vulnerability identifier: #VU69394

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-2601

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to bypass implemented security restrictions.

The vulnerability exists due to a boundary error within the grub_font_construct_glyph() function when handling pf2 font. An attacker with physical access to the affected system can trigger an out-of-bounds write and bypass secure boot restrictions.

grub
Debian Linux
Amazon Linux AMI
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Module for SUSE Manager Proxy
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Anolis OS
Oracle Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
openSUSE Leap
openEuler
Fedora
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
EMC Cloud Tiering Appliance
Submariner
IBM Spectrum Copy Data Management
Red Hat Advanced Cluster Management for Kubernetes
IBM Watson Assistant for IBM Cloud Pak for Data
Red Hat Migration Toolkit for Applications
Oracle SD-WAN Edge
Dell Secure Connect Gateway
Session Smart Router
IBM Spectrum Protect Plus
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
grub2-efi-ia32
grub2-efi-x64-cdboot
grub2-pc
grub2-common
grub2-efi-aa64-modules
grub2-efi-ia32-modules
grub2-efi-x64-modules
grub2-pc-modules
grub2-efi-x64
grub2-efi-ia32-cdboot
grub2-tools-minimal
grub2-tools-extra
grub2-tools
grub2-efi-aa64-cdboot
grub2-efi-aa64
grub2
grub2 (Red Hat package)
grub2-debugsource
grub2-snapper-plugin
grub2-systemd-sleep-plugin
grub2-x86_64-xen
grub2-x86_64-efi
grub2-i386-pc
grub2-debuginfo
grub2-s390x-emu
grub2-arm64-efi
grub2-powerpc-ieee1275
grub2-tools-efi
grub2-help
grub2-branding-upstream
grub2-arm64-efi-debug
grub2-i386-pc-debug
grub2-powerpc-ieee1275-debug
grub2-x86_64-efi-debug
grub2-s390x-emu-debug
sys-boot/grub
grub2 (Debian package)
Dell EMC NetWorker vProxy
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM
RecoverPoint for VMs
Dell EMC VxRail Appliance
IBM Security Guardium

Install update from vendor's website.

Submariner - update to 0.14.0
IBM Spectrum Copy Data Management - update to 2.2.19.0
Red Hat Advanced Cluster Management for Kubernetes - update to 2.6.4
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
Red Hat Migration Toolkit for Applications - update to 6.0.1
Oracle SD-WAN Edge - update to 9.1.1.9.0
grub2-efi-ia32 - update to 2.02-0.87
grub2-efi-x64-cdboot - update to 2.02-0.87
grub2-pc - update to 2.02-0.87
grub2-common - update to 2.02-0.87
grub2-efi-aa64-modules - update to 2.02-0.87
grub2-efi-ia32-modules - update to 2.02-0.87
grub2-efi-x64-modules - update to 2.02-0.87
grub2-pc-modules - update to 2.02-0.87
grub2-efi-x64 - update to 2.02-0.87
grub2-efi-ia32-cdboot - update to 2.02-0.87
grub2-tools-minimal - update to 2.02-0.87
grub2-tools-extra - update to 2.02-0.87
grub2-tools - update to 2.02-0.87
grub2-efi-aa64-cdboot - update to 2.02-0.87
grub2-efi-aa64 - update to 2.02-0.87
grub2 - update to 2.02-0.87
grub2 (Red Hat package) - addressed in versions 2.02-0.87.el7_9.14, 2.02-87.el8_1.11, 2.02-87.el8_2.11, 2.02-99.el8_4.10, 2.02-123.el8_6.12, 2.02-142.el8_7.1, 2.06-27.el9_0.12, 2.06-46.el9_1.3
grub2-debugsource - addressed in versions 2.02-115.72.1, 2.02-142.1, 2.02-153.1, 2.02-150000.122.17.1, 2.02-150100.123.17.1, 2.04-150200.9.68.1, 2.04-150300.3.8.1, 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-snapper-plugin - addressed in versions 2.02-115.72.1, 2.02-142.1, 2.02-153.1, 2.02-150000.122.17.1, 2.02-150100.123.17.1, 2.04-150200.9.68.1, 2.04-150300.3.8.1, 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-systemd-sleep-plugin - addressed in versions 2.02-115.72.1, 2.02-142.1, 2.02-153.1, 2.02-150000.122.17.1, 2.02-150100.123.17.1, 2.04-150200.9.68.1, 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2 - addressed in versions 2.02-115.72.1, 2.02-142.1, 2.02-153.1, 2.02-150000.122.17.1, 2.02-150100.123.17.1, 2.04-150200.9.68.1, 2.04-150300.3.8.1, 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-x86_64-xen - addressed in versions 2.02-115.72.1, 2.02-142.1, 2.02-153.1, 2.02-150000.122.17.1, 2.02-150100.123.17.1, 2.04-150200.9.68.1, 2.04-150300.3.8.1, 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-x86_64-efi - addressed in versions 2.02-115.72.1, 2.02-142.1, 2.02-153.1, 2.02-150000.122.17.1, 2.02-150100.123.17.1, 2.04-150200.9.68.1, 2.04-150300.3.8.1, 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-i386-pc - addressed in versions 2.02-115.72.1, 2.02-142.1, 2.02-153.1, 2.02-150000.122.17.1, 2.02-150100.123.17.1, 2.04-150200.9.68.1, 2.04-150300.3.8.1, 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-debuginfo - addressed in versions 2.02-115.72.1, 2.02-142.1, 2.02-153.1, 2.02-150000.122.17.1, 2.02-150100.123.17.1, 2.04-150200.9.68.1, 2.04-150300.3.8.1, 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-s390x-emu - addressed in versions 2.02-153.1, 2.02-150000.122.17.1, 2.02-150100.123.17.1, 2.04-150200.9.68.1, 2.04-150300.3.8.1, 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-arm64-efi - addressed in versions 2.02-153.1, 2.02-150000.122.17.1, 2.02-150100.123.17.1, 2.04-150200.9.68.1, 2.04-150300.3.8.1, 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-powerpc-ieee1275 - addressed in versions 2.02-153.1, 2.02-150000.122.17.1, 2.02-150100.123.17.1, 2.04-150200.9.68.1, 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-tools - update to 2.04-26
grub2-efi-aa64-cdboot - update to 2.04-26
grub2-tools-extra - update to 2.04-26
grub2-tools-efi - update to 2.04-26
grub2-debuginfo - update to 2.04-26
grub2 - update to 2.04-26
grub2-efi-aa64 - update to 2.04-26
grub2-tools-minimal - update to 2.04-26
grub2-efi-ia32 - update to 2.04-26
grub2-efi-x64-cdboot - update to 2.04-26
grub2-pc - update to 2.04-26
grub2-efi-ia32-cdboot - update to 2.04-26
grub2-efi-x64 - update to 2.04-26
grub2-efi-x64-modules - update to 2.04-26
grub2-debugsource - update to 2.04-26
grub2-efi-ia32-modules - update to 2.04-26
grub2-pc-modules - update to 2.04-26
grub2-efi-aa64-modules - update to 2.04-26
grub2-help - update to 2.04-26
grub2-common - update to 2.04-26
grub2-branding-upstream - addressed in versions 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-arm64-efi-debug - addressed in versions 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-i386-pc-debug - addressed in versions 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-powerpc-ieee1275-debug - addressed in versions 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-x86_64-efi-debug - addressed in versions 2.04-150300.22.25.1, 2.06-150400.11.17.1
grub2-s390x-emu-debug - addressed in versions 2.04-150300.22.25.1, 2.06-150400.11.17.1
sys-boot/grub - update to 2.06-r9
grub2 (Debian package) - update to 2.06-3~deb11u4
grub2 - addressed in versions 2.06-12.fc35, 2.06-13.fc35, 2.06-14.fc35, 2.06-55.fc36, 2.06-56.fc36, 2.06-57.fc36, 2.06-63.fc37
grub2 - update to 2.06-61
Dell EMC NetWorker vProxy - update to 4.3.0-40
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.9.0.0
EMC ViPR SRM - update to 4.9.0.0
Dell Secure Connect Gateway - update to 5.14.00.16
RecoverPoint for VMs - update to 6.0.SP1.P1
Session Smart Router - addressed in versions 6.2.10, 6.3.7
Dell EMC VxRail Appliance - update to 7.0.411
IBM Spectrum Protect Plus - update to 10.1.14
IBM Security Guardium - update to 11.0 p545
EMC Cloud Tiering Appliance - update to 13.1.0.2.29

• https://bugzilla.redhat.com/show_bug.cgi?id=2112975

• Multiple vulnerabilities in GNU grub
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for grub2
• Debian update for grub2
• SUSE update for grub2
• SUSE update for grub2
• SUSE update for grub2
• SUSE update for grub2
• SUSE update for grub2
• SUSE update for grub2
• SUSE update for grub2
• SUSE update for grub2
• Red Hat Enterprise Linux 8 update for grub2
• Red Hat Enterprise Linux 9.0 Extended Update Support update for grub2
• Red Hat Enterprise Linux 8 update for grub2
• Red Hat Enterprise Linux 8.6 Extended Update Support update for grub2
• Red Hat Enterprise Linux 8.4 Extended Update Support update for grub2
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Submariner
• Red Hat Enterprise Linux 9 update for grub2
• Red Hat Advanced Cluster Management for Kubernetes 2.6 update for Submariner
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in IBM Spectrum Copy Data Management
• SUSE update for grub2
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in Dell NetWorker vProxy
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Gentoo update for GRUB
• openEuler update for grub2
• Red Hat Enterprise Linux 7 update for grub2
• Amazon Linux AMI update for grub2
• Out-of-bounds write in IBM Security Guardium
• Multiple vulnerabilities in Oracle SD-WAN Edge
• Fedora 35 update for grub2
• Fedora 36 update for grub2
• Fedora 37 update for grub2
• Fedora 36 update for grub2
• Fedora 35 update for grub2
• Fedora 35 update for grub2
• Fedora 36 update for grub2
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Anolis OS update for grub2
• Juniper Session Smart Router update for third-party components