THREATIST.IORead the docs grub2, mokutil, shim, and shim-unsigned-x64 security update
Released 2022-06-16 · Red Hat rating Important · View on Red Hat →
Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value.
Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position.
There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded.
There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2.
The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems.
A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap.
A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader.
A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area.