CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-28733 – Integer underflow in grub_net_recv_ip4_packets
https://notcve.org/view.php?id=CVE-2022-28733
Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a small integer number which will be used in memory allocation. If the attack succeeds in such way, subsequent operations can write past the end of the buffer. A flaw was found in grub2 when handling IPv4 packets. This flaw allows an attacker to craft a malicious packet, triggering an integer underflow in grub code. • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28733 https://security.netapp.com/advisory/ntap-20230825-0002 https://www.openwall.com/lists/oss-security/2022/06/07/5 https://access.redhat.com/security/cve/CVE-2022-28733 https://bugzilla.redhat.com/show_bug.cgi?id=2083339 • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-28735 – grub2: shim_lock verifier allows non-kernel files to be loaded
https://notcve.org/view.php?id=CVE-2022-28735
The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules to be loaded in GRUB2 breaking the secure boot trust-chain. A flaw was found in grub2. The shim_lock verifier from grub2 allows non-kernel files to be loaded when secure boot is enabled, giving the possibility of unverified code or modules to be loaded when it should not be allowed. • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28735 https://security.netapp.com/advisory/ntap-20230825-0002 https://www.openwall.com/lists/oss-security/2022/06/07/5 https://access.redhat.com/security/cve/CVE-2022-28735 https://bugzilla.redhat.com/show_bug.cgi?id=2090857 • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-28736 – There's a use-after-free vulnerability in grub_cmd_chainloader() function
https://notcve.org/view.php?id=CVE-2022-28736
There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved. A use-after-free vulnerability was found on grub2's chainloader command. This flaw allows an attacker to gain access to restricted data or cause arbitrary code execution if they can establish control from grub's memory allocation pattern. • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28736 https://security.netapp.com/advisory/ntap-20230825-0002 https://www.openwall.com/lists/oss-security/2022/06/07/5 https://access.redhat.com/security/cve/CVE-2022-28736 https://bugzilla.redhat.com/show_bug.cgi?id=2092613 • CWE-416: Use After Free •
CVSS: 5.1EPSS: 0%CPEs: 4EXPL: 1CVE-2021-46705 – grub2-once uses fixed file name in /var/tmp
https://notcve.org/view.php?id=CVE-2021-46705
A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1. Una vulnerabilidad de Archivos Temporales no Seguros en grub-once de grub2 en SUSE Linux Enterprise Server 15 SP4, openSUSE Factory permite a atacantes locales truncar archivos arbitrarios. Este problema afecta a: SUSE Linux Enterprise Server 15 SP4 grub2 versiones anteriores a 2.06-150400.7.1. • https://bugzilla.suse.com/show_bug.cgi?id=1190474 • CWE-377: Insecure Temporary File •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-3981 – grub2: Incorrect permission in grub.cfg allow unprivileged user to read the file content
https://notcve.org/view.php?id=CVE-2021-3981
A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in grub.cfg. This flaw affects grub2 2.06 and previous versions. This issue has been fixed in grub upstream but no version with the fix is currently released. Se ha encontrado un fallo en grub2 en el que su archivo de configuración, conocido como grub.cfg, es creado con un conjunto de permisos erróneo que permite a usuarios no privilegiado leer su contenido. • http://www.openwall.com/lists/oss-security/2024/01/15/3 https://bugzilla.redhat.com/show_bug.cgi?id=2024170 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AI776L35DDYPCSAAJPJM3ZEQYSFZHBJX https://security.gentoo.org/glsa/202209-12 https://access.redhat.com/security/cve/CVE-2021-3981 • CWE-276: Incorrect Default Permissions •