Description

A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.

INFO

Published Date :

Dec. 14, 2022, 9:15 p.m.

Last Modified :

Nov. 25, 2023, 12:15 p.m.

Remotely Exploitable :

No

Impact Score :

6.0

Exploitability Score :

1.8
Public PoC/Exploit Available at Github

CVE-2022-2601 has a 16 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2022-2601 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Redhat enterprise_linux_server_aus
2 Redhat enterprise_linux_server_tus
3 Redhat enterprise_linux_eus
4 Redhat enterprise_linux_for_power_little_endian_eus
5 Redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
6 Redhat enterprise_linux_server_update_services_for_sap_solutions
1 Fedoraproject fedora
1 Gnu grub2
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2022-2601.

URL Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0 Issue Tracking Third Party Advisory
https://security.gentoo.org/glsa/202311-14
https://security.netapp.com/advisory/ntap-20230203-0004/

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

None

Dockerfile

Updated: 1 month ago
0 stars 0 fork 0 watcher
Born at : Oct. 5, 2024, 8:41 a.m. This repo has been linked 28 different CVEs too.

None

Dockerfile Makefile

Updated: 1 month, 4 weeks ago
0 stars 0 fork 0 watcher
Born at : Sept. 6, 2024, 10:39 a.m. This repo has been linked 28 different CVEs too.

None

Dockerfile

Updated: 2 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : May 23, 2024, 1:34 p.m. This repo has been linked 28 different CVEs too.

None

Updated: 5 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : May 17, 2024, 8:53 p.m. This repo has been linked 24 different CVEs too.

None

Dockerfile Shell

Updated: 5 months, 2 weeks ago
0 stars 1 fork 1 watcher
Born at : May 17, 2024, 8:46 p.m. This repo has been linked 28 different CVEs too.

None

Dockerfile

Updated: 4 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : March 4, 2024, 8:25 p.m. This repo has been linked 28 different CVEs too.

Repository for all information needed for shim-review

Dockerfile

Updated: 9 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Jan. 15, 2024, 9:57 a.m. This repo has been linked 28 different CVEs too.

Wazuh vulnerability report maker

Python

Updated: 3 months, 3 weeks ago
2 stars 1 fork 1 watcher
Born at : Sept. 14, 2023, 3:32 p.m. This repo has been linked 8 different CVEs too.

shim-review for Navix

Dockerfile

Updated: 1 year, 1 month ago
0 stars 0 fork 0 watcher
Born at : Aug. 28, 2023, 8:02 a.m. This repo has been linked 28 different CVEs too.

A centralized repository of standalone security patches for open source libraries.

appsec backport cve devsecops fix hotfix open-source patch protection remediation seal security update upgrade vulnerability

Updated: 4 months, 1 week ago
182 stars 0 fork 0 watcher
Born at : July 30, 2023, 4:46 p.m. This repo has been linked 265 different CVEs too.

None

Updated: 1 year, 5 months ago
0 stars 0 fork 0 watcher
Born at : May 28, 2023, 10:13 a.m. This repo has been linked 24 different CVEs too.

None

Dockerfile Makefile

Updated: 9 months ago
1 stars 0 fork 0 watcher
Born at : Dec. 14, 2022, 11:14 p.m. This repo has been linked 24 different CVEs too.

None

Dockerfile

Updated: 2 years, 4 months ago
0 stars 0 fork 0 watcher
Born at : July 2, 2022, 8:27 p.m. This repo has been linked 24 different CVEs too.

None

Dockerfile

Updated: 2 years, 3 months ago
0 stars 0 fork 0 watcher
Born at : Oct. 18, 2019, 9:18 p.m. This repo has been linked 24 different CVEs too.

Reviews of shim

Updated: 2 months, 4 weeks ago
66 stars 112 fork 112 watcher
Born at : Dec. 5, 2017, 7:57 p.m. This repo has been linked 28 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2022-2601 vulnerability anywhere in the article.

  • BleepingComputer
Microsoft shares temp fix for Linux boot issues on dual-boot systems

​Microsoft has provided a workaround to temporarily fix a known issue that is blocking Linux from booting on dual-boot systems with Secure Boot enabled. The company says this temporary fix can help Li ... Read more

Published Date: Aug 23, 2024 (2 months, 1 week ago)
  • BleepingComputer
Microsoft confirms August updates break Linux boot in dual-boot systems

Microsoft has confirmed the August 2024 Windows security updates are causing Linux booting issues on dual-boot systems with Secure Boot enabled. The issue is caused by a Secure Boot Advanced Targeting ... Read more

Published Date: Aug 22, 2024 (2 months, 1 week ago)
  • The Register
Microsoft's Patch Tuesday borks dual-boot Linux-Windows PCs

Microsoft says it's investigating issues with a patch intended to plug a two-year-old flaw in the GRUB open source boot loader that is crashing some dual-boot computers running both Windows and Linux. ... Read more

Published Date: Aug 21, 2024 (2 months, 2 weeks ago)
  • Ars Technica
“Something has gone seriously wrong,” dual-boot systems warn after Microsoft update

HELLO, MICROSOFT? YOU THERE? — Microsoft said its update wouldn't install on Linux devices. It did anyway. Getty Images Last Tuesday, loads of Linux users—many running packages released as early as ... Read more

Published Date: Aug 21, 2024 (2 months, 2 weeks ago)
  • BleepingComputer
August Windows updates break dual boot on some Linux systems

According to user reports following this month's Patch Tuesday, the August 2024 Windows security updates are breaking dual boot on some Linux systems with Secure Boot enabled. This issue is caused by ... Read more

Published Date: Aug 20, 2024 (2 months, 2 weeks ago)
  • BleepingComputer
August Windows security update breaks dual boot on Linux systems

According to user reports following this month's Patch Tuesday, the August 2024 Windows security updates are breaking dual boot on some Linux systems with Secure Boot enabled. This issue is caused by ... Read more

Published Date: Aug 20, 2024 (2 months, 2 weeks ago)

The following table lists the changes that have been made to the CVE-2022-2601 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Nov. 25, 2023

    Action Type Old Value New Value
    Added Reference Red Hat, Inc. https://security.gentoo.org/glsa/202311-14 [No types assigned]
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Removed CWE Red Hat, Inc. CWE-787
  • CVE Modified by [email protected]

    Feb. 03, 2023

    Action Type Old Value New Value
    Added Reference https://security.netapp.com/advisory/ntap-20230203-0004/ [No Types Assigned]
  • Initial Analysis by [email protected]

    Dec. 16, 2022

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    Changed Reference Type https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0 No Types Assigned https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0 Issue Tracking, Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* versions up to (including) 2.06
    Added CPE Configuration OR *cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2022-2601 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2022-2601 weaknesses.

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.08 }} 0.01%

score

0.32645

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability