CVE-2022-2601

grub2: Buffer overflow in grub_font_construct_glyph() can lead to out-of-bound write and possible secure boot bypass

Loading…

Severity

Moderate

Red Hat Product Security

8.2

CVSS 3.1

Review impact separately from score.

Published · November 15, 2022

Updated · May 28, 2026

Description

A flaw was found where a maliciously crafted pf2 font could lead to an out-of-bounds write in grub2. A successful attack can lead to memory corruption and secure boot circumvention.

Statement

Grub code needs to be updated after installing the relevant RPM.

For RHEL systems installed on machines with EFI based BIOS : sudo grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg For RHEL systems installed on machines with legacy (msdos) based BIOS : sudo grub2-mkconfig -o /boot/grub2/grub.cfg

For BIOS based systems, after completing yum update, grub2-install needs to be run against the device where the boot partition is, for example, grub2-install /dev/vda.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 8.2
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE-787 · Out-of-bounds Write