CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-28734 – Out-of-bounds write when handling split HTTP headers
https://notcve.org/view.php?id=CVE-2022-28734
Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NULL byte past the buffer. It's conceivable that an attacker controlled set of packets can lead to corruption of the GRUB2's internal memory metadata. A flaw was found in grub2 when handling split HTTP headers. While processing a split HTTP header, grub2 wrongly advances its control pointer to the internal buffer by one position, which can lead to an out-of-bounds write. • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28734 https://security.netapp.com/advisory/ntap-20230825-0002 https://www.openwall.com/lists/oss-security/2022/06/07/5 https://access.redhat.com/security/cve/CVE-2022-28734 https://bugzilla.redhat.com/show_bug.cgi?id=2090463 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-28735 – grub2: shim_lock verifier allows non-kernel files to be loaded
https://notcve.org/view.php?id=CVE-2022-28735
The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules to be loaded in GRUB2 breaking the secure boot trust-chain. A flaw was found in grub2. The shim_lock verifier from grub2 allows non-kernel files to be loaded when secure boot is enabled, giving the possibility of unverified code or modules to be loaded when it should not be allowed. • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28735 https://security.netapp.com/advisory/ntap-20230825-0002 https://www.openwall.com/lists/oss-security/2022/06/07/5 https://access.redhat.com/security/cve/CVE-2022-28735 https://bugzilla.redhat.com/show_bug.cgi?id=2090857 • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-28736 – There's a use-after-free vulnerability in grub_cmd_chainloader() function
https://notcve.org/view.php?id=CVE-2022-28736
There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved. A use-after-free vulnerability was found on grub2's chainloader command. This flaw allows an attacker to gain access to restricted data or cause arbitrary code execution if they can establish control from grub's memory allocation pattern. • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28736 https://security.netapp.com/advisory/ntap-20230825-0002 https://www.openwall.com/lists/oss-security/2022/06/07/5 https://access.redhat.com/security/cve/CVE-2022-28736 https://bugzilla.redhat.com/show_bug.cgi?id=2092613 • CWE-416: Use After Free •
CVSS: 5.1EPSS: 0%CPEs: 4EXPL: 1CVE-2021-46705 – grub2-once uses fixed file name in /var/tmp
https://notcve.org/view.php?id=CVE-2021-46705
A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1. Una vulnerabilidad de Archivos Temporales no Seguros en grub-once de grub2 en SUSE Linux Enterprise Server 15 SP4, openSUSE Factory permite a atacantes locales truncar archivos arbitrarios. Este problema afecta a: SUSE Linux Enterprise Server 15 SP4 grub2 versiones anteriores a 2.06-150400.7.1. • https://bugzilla.suse.com/show_bug.cgi?id=1190474 • CWE-377: Insecure Temporary File •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-3981 – grub2: Incorrect permission in grub.cfg allow unprivileged user to read the file content
https://notcve.org/view.php?id=CVE-2021-3981
A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in grub.cfg. This flaw affects grub2 2.06 and previous versions. This issue has been fixed in grub upstream but no version with the fix is currently released. Se ha encontrado un fallo en grub2 en el que su archivo de configuración, conocido como grub.cfg, es creado con un conjunto de permisos erróneo que permite a usuarios no privilegiado leer su contenido. • http://www.openwall.com/lists/oss-security/2024/01/15/3 https://bugzilla.redhat.com/show_bug.cgi?id=2024170 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AI776L35DDYPCSAAJPJM3ZEQYSFZHBJX https://security.gentoo.org/glsa/202209-12 https://access.redhat.com/security/cve/CVE-2021-3981 • CWE-276: Incorrect Default Permissions •