Read the docs
TI-2022-03464 Aliases CVE-2022-3775GHSA-8h84-vmjf-pcmj

Out-of-bounds write in grub2

Priority LOW 35CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Partial Red Hat: 9 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01044 64th percentileScored 2026-11-07
Fix Partial Red Hat: 7 advisoriesRed Hat: 9 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—grub2All up to 2.06—No fix listedCNA
  • grub2 Vendor— Affected All up to 2.06 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*up to 2.06VulnerableGNU
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
  • cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* Versions up to 2.06 Vulnerable ·GNU
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat

Remediation

Red Hat 7 advisories

  • RHSA-2023:0752 Released 2023-02-14 · Red Hat rating Moderate
    grub2 security update
    • Red Hat Enterprise Linux BaseOS (v. 9) grub2-1:2.06-46.el9_1.3, grub2-common-1:2.06-46.el9_1.3, grub2-efi-aa64-1:2.06-46.el9_1.3 +13
  • RHSA-2023:0047 Released 2023-01-09 · Red Hat rating Moderate
    grub2 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.4) grub2-1:2.02-99.el8_4.10, grub2-common-1:2.02-99.el8_4.10, grub2-efi-aa64-1:2.02-99.el8_4.10 +16
  • RHSA-2023:0048 Released 2023-01-09 · Red Hat rating Moderate
    grub2 security and bug fix update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.6) grub2-1:2.02-123.el8_6.12, grub2-common-1:2.02-123.el8_6.12, grub2-efi-aa64-1:2.02-123.el8_6.12 +16
Show 4 more Red Hat advisories
  • RHSA-2023:0049 Released 2023-01-09 · Red Hat rating Moderate
    grub2 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) grub2-1:2.02-142.el8_7.1, grub2-common-1:2.02-142.el8_7.1, grub2-efi-aa64-1:2.02-142.el8_7.1 +16
  • RHSA-2022:8978 Released 2022-12-13 · Red Hat rating Moderate
    grub2 security and bug fix update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.0) grub2-1:2.06-27.el9_0.12, grub2-common-1:2.06-27.el9_0.12, grub2-efi-aa64-1:2.06-27.el9_0.12 +13
  • RHSA-2022:8800 Released 2022-12-06 · Red Hat rating Moderate
    grub2 security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) grub2-1:2.02-87.el8_2.11, grub2-common-1:2.02-87.el8_2.11, grub2-efi-aa64-modules-1:2.02-87.el8_2.11 +13
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.2) grub2-1:2.02-87.el8_2.11, grub2-common-1:2.02-87.el8_2.11, grub2-efi-aa64-modules-1:2.02-87.el8_2.11 +14
    • Red Hat Enterprise Linux BaseOS TUS (v. 8.2) grub2-1:2.02-87.el8_2.11, grub2-common-1:2.02-87.el8_2.11, grub2-efi-aa64-modules-1:2.02-87.el8_2.11 +13
  • RHSA-2022:8494 Released 2022-11-16 · Red Hat rating Moderate
    grub2 security update
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) grub2-1:2.02-87.el8_1.11, grub2-common-1:2.02-87.el8_1.11, grub2-efi-aa64-modules-1:2.02-87.el8_1.11 +14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    grub2 — GLSA-202311-14

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-02403 Heap-based buffer overflow in grub2Priority MEDIUM 40
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2023:0049
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2023:0752
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2022:8800
Red Hat Enterprise Linux BaseOS E4S (v. 8.1)Fixed RHSA-2022:8494
Red Hat Enterprise Linux BaseOS E4S (v. 8.2)Fixed RHSA-2022:8800
Red Hat Enterprise Linux BaseOS EUS (v.8.4)Fixed RHSA-2023:0047
Red Hat Enterprise Linux BaseOS EUS (v.8.6)Fixed RHSA-2023:0048
Red Hat Enterprise Linux BaseOS EUS (v.9.0)Fixed RHSA-2022:8978
Red Hat Enterprise Linux BaseOS TUS (v. 8.2)Fixed RHSA-2022:8800

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3775
  2. 2026-10-03 Alias added: GHSA-8h84-vmjf-pcmj

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences