Read the docs
TI-2022-02403 Aliases CVE-2022-2601GHSA-c8f6-x9xm-x27g

Heap-based buffer overflow in grub2

Priority MEDIUM 40CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00515 44th percentileScored 2026-11-07
Fix Fixed Red Hat: 8 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—grub2grub2 2.06 and lower—No fix listedCNA
  • grub2 Vendor— Affected grub2 2.06 and lower Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*up to 2.06VulnerableGNU
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*8.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*8.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*8.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*8.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*8.1VulnerableRed Hat
  • cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* Versions up to 2.06 Vulnerable ·GNU
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*8.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat

Remediation

Red Hat 8 advisories

  • RHSA-2024:2002 Released 2024-04-23 · Red Hat rating Moderate
    grub2 security update
    • Red Hat Enterprise Linux Client (v. 7) grub2-1:2.02-0.87.el7_9.14, grub2-common-1:2.02-0.87.el7_9.14, grub2-efi-ia32-1:2.02-0.87.el7_9.14 +8
    • Red Hat Enterprise Linux Client Optional (v. 7) grub2-efi-aa64-modules-1:2.02-0.87.el7_9.14, grub2-efi-ia32-cdboot-1:2.02-0.87.el7_9.14, grub2-efi-x64-cdboot-1:2.02-0.87.el7_9.14 +3
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) grub2-efi-aa64-modules-1:2.02-0.87.el7_9.14, grub2-efi-ia32-cdboot-1:2.02-0.87.el7_9.14, grub2-efi-x64-cdboot-1:2.02-0.87.el7_9.14 +3
    • Red Hat Enterprise Linux Server (v. 7) grub2-1:2.02-0.87.el7_9.14, grub2-common-1:2.02-0.87.el7_9.14, grub2-efi-ia32-1:2.02-0.87.el7_9.14 +12
    • Red Hat Enterprise Linux Server Optional (v. 7) grub2-efi-aa64-modules-1:2.02-0.87.el7_9.14, grub2-efi-ia32-cdboot-1:2.02-0.87.el7_9.14, grub2-efi-ia32-modules-1:2.02-0.87.el7_9.14 +6
    • Red Hat Enterprise Linux Workstation (v. 7) grub2-1:2.02-0.87.el7_9.14, grub2-common-1:2.02-0.87.el7_9.14, grub2-efi-ia32-1:2.02-0.87.el7_9.14 +8
    • Red Hat Enterprise Linux Workstation Optional (v. 7) grub2-efi-aa64-modules-1:2.02-0.87.el7_9.14, grub2-efi-ia32-cdboot-1:2.02-0.87.el7_9.14, grub2-efi-x64-cdboot-1:2.02-0.87.el7_9.14 +3
  • RHSA-2023:0752 Released 2023-02-14 · Red Hat rating Moderate
    grub2 security update
    • Red Hat Enterprise Linux BaseOS (v. 9) grub2-1:2.06-46.el9_1.3, grub2-common-1:2.06-46.el9_1.3, grub2-efi-aa64-1:2.06-46.el9_1.3 +13
  • RHSA-2023:0047 Released 2023-01-09 · Red Hat rating Moderate
    grub2 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.4) grub2-1:2.02-99.el8_4.10, grub2-common-1:2.02-99.el8_4.10, grub2-efi-aa64-1:2.02-99.el8_4.10 +16
Show 5 more Red Hat advisories
  • RHSA-2023:0048 Released 2023-01-09 · Red Hat rating Moderate
    grub2 security and bug fix update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.6) grub2-1:2.02-123.el8_6.12, grub2-common-1:2.02-123.el8_6.12, grub2-efi-aa64-1:2.02-123.el8_6.12 +16
  • RHSA-2023:0049 Released 2023-01-09 · Red Hat rating Moderate
    grub2 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) grub2-1:2.02-142.el8_7.1, grub2-common-1:2.02-142.el8_7.1, grub2-efi-aa64-1:2.02-142.el8_7.1 +16
  • RHSA-2022:8978 Released 2022-12-13 · Red Hat rating Moderate
    grub2 security and bug fix update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.0) grub2-1:2.06-27.el9_0.12, grub2-common-1:2.06-27.el9_0.12, grub2-efi-aa64-1:2.06-27.el9_0.12 +13
  • RHSA-2022:8800 Released 2022-12-06 · Red Hat rating Moderate
    grub2 security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) grub2-1:2.02-87.el8_2.11, grub2-common-1:2.02-87.el8_2.11, grub2-efi-aa64-modules-1:2.02-87.el8_2.11 +13
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.2) grub2-1:2.02-87.el8_2.11, grub2-common-1:2.02-87.el8_2.11, grub2-efi-aa64-modules-1:2.02-87.el8_2.11 +14
    • Red Hat Enterprise Linux BaseOS TUS (v. 8.2) grub2-1:2.02-87.el8_2.11, grub2-common-1:2.02-87.el8_2.11, grub2-efi-aa64-modules-1:2.02-87.el8_2.11 +13
  • RHSA-2022:8494 Released 2022-11-16 · Red Hat rating Moderate
    grub2 security update
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) grub2-1:2.02-87.el8_1.11, grub2-common-1:2.02-87.el8_1.11, grub2-efi-aa64-modules-1:2.02-87.el8_1.11 +14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    grub2 — GLSA-202311-14

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2023:0049
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2023:0752
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2022:8800
Red Hat Enterprise Linux BaseOS E4S (v. 8.1)Fixed RHSA-2022:8494
Red Hat Enterprise Linux BaseOS E4S (v. 8.2)Fixed RHSA-2022:8800
Red Hat Enterprise Linux BaseOS EUS (v.8.4)Fixed RHSA-2023:0047
Red Hat Enterprise Linux BaseOS EUS (v.8.6)Fixed RHSA-2023:0048
Red Hat Enterprise Linux BaseOS EUS (v.9.0)Fixed RHSA-2022:8978
Red Hat Enterprise Linux BaseOS TUS (v. 8.2)Fixed RHSA-2022:8800
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2024:2002
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2024:2002
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2024:2002
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2024:2002
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2024:2002
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2024:2002
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2024:2002

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2601
  2. 2026-10-03 Alias added: GHSA-c8f6-x9xm-x27g

References

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences