Moderate: grub2 security update
Summary
ALSA-2023:0752: Moderate: grub2 security update. Affects grub2-common versions < 1:2.06-46.el9_1.3.alma. Fixed in 1:2.06-46.el9_1.3.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.
Vulnerability Detail
The vulnerability in the grub2 package is a buffer overflow in the grub_font_construct_glyph() function, which can lead to an out-of-bound write and possible secure boot bypass (CVE-2022-2601). Additionally, there is a heap-based out-of-bounds write vulnerability when rendering certain unicode sequences (CVE-2022-3775). These vulnerabilities can be exploited by an attacker to execute arbitrary code or bypass secure boot mechanisms.
How To Fix
Minimum fixed version
1:2.06-46.el9_1.3.alma
This is the first release that contains the fix.
sudo dnf update grub2-commonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
It is recommended to update the grub2 packages to the fixed version to mitigate the risk of these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for grub2-common →
FAQ
These vulnerabilities can allow an attacker to execute arbitrary code or bypass secure boot mechanisms.
Yes, all versions of the grub2 package prior to 2.06-46.el9_1.3.alma are affected.
The CVSS score for these vulnerabilities has not been provided in the vulnerability details.
There are no known exploits for these vulnerabilities at the time of this advisory.
More information about these vulnerabilities can be found on the CVE pages: CVE-2022-2601 and CVE-2022-3775.
Related vulnerabilities
Recent vulnerabilities recorded for grub2-common.
