CVE-2022-2601

Katalog CVE

CVSS 8.6 · High EPSS 0,51%

Kerentanan Heap-based Buffer Overflow pada gnu grub2, fedoraproject fedora +6 lainnya. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.

Rincian

Terbit di NVD

14 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 42,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0 issue tracking · advisory pihak ketiga
• https://security.gentoo.org/glsa/202311-14
• https://security.netapp.com/advisory/ntap-20230203-0004/
• https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-l...