Read the docs
TI-2022-11368 Aliases CVE-2022-28734GHSA-h8v2-pvw7-3jf5

Out-of-bounds write in GNU GRUB

Priority LOW 37CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NULL byte past the buffer. It's conceivable that an attacker controlled set of packets can lead to corruption of the GRUB2's internal memory metadata.

Why it matters now

EPSS 0.01121 66th percentileScored 2026-11-07
Fix Partial GNU GRUB (GNU Project): 2.06-3Red Hat: 5 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNUGNU GRUBbefore 2.06-32.06-3Patch availableCNA
  • GNU GRUB VendorGNU Affected before 2.06-3 Fixed in 2.06-3 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*2.00 to before 2.06-3VulnerableGNU
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* Versions 2.00 to before 2.06-3 Vulnerable ·GNU
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · CNA GNU GRUB (GNU Project) Fixed in 2.06-3

Red Hat 5 advisories

  • RHSA-2022:5100 Released 2022-06-16 · Red Hat rating Important
    grub2, mokutil, shim, and shim-unsigned-x64 security update
    • Red Hat CodeReady Linux Builder EUS (v. 8.2) shim-unsigned-x64-15.6-1.el8
    • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) grub2-1:2.02-87.el8_2.10, grub2-common-1:2.02-87.el8_2.10, grub2-efi-aa64-1:2.02-87.el8_2.10 +20
  • RHSA-2022:5095 Released 2022-06-16 · Red Hat rating Important
    grub2, mokutil, shim, and shim-unsigned-x64 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) grub2-1:2.02-123.el8_6.8, grub2-common-1:2.02-123.el8_6.8, grub2-efi-aa64-1:2.02-123.el8_6.8 +20
    • Red Hat Enterprise Linux CRB (v. 8) shim-unsigned-x64-15.6-1.el8
  • RHSA-2022:5099 Released 2022-06-16 · Red Hat rating Important
    grub2, mokutil, shim, and shim-unsigned-x64 security update
    • Red Hat CodeReady Linux Builder (v. 9) shim-unsigned-x64-15.6-1.el9
    • Red Hat Enterprise Linux BaseOS (v. 9) grub2-1:2.06-27.el9_0.7, grub2-common-1:2.06-27.el9_0.7, grub2-efi-aa64-1:2.06-27.el9_0.7 +16
Show 2 more Red Hat advisories
  • RHSA-2022:5096 Released 2022-06-16 · Red Hat rating Important
    grub2, mokutil, shim, and shim-unsigned-x64 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.4) grub2-1:2.02-99.el8_4.9, grub2-common-1:2.02-99.el8_4.9, grub2-efi-aa64-1:2.02-99.el8_4.9 +20
    • Red Hat Enterprise Linux CRB EUS (v.8.4) shim-unsigned-x64-15.6-1.el8
  • RHSA-2022:5098 Released 2022-06-16 · Red Hat rating Important
    grub2, mokutil, and shim security update
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) grub2-1:2.02-87.el8_1.10, grub2-common-1:2.02-87.el8_1.10, grub2-efi-aa64-modules-1:2.02-87.el8_1.10 +17

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GNU GRUB 2.06-3

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2022-11367 Integer underflow in GNU GRUBPriority MEDIUM 40
    • TI-2022-11370 Use after free in GNU GRUBPriority LOW 36
    • TI-2022-11369 The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered…Priority LOW 36
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2022:5095
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2022:5099
Red Hat Enterprise Linux BaseOS E4S (v. 8.1)Fixed RHSA-2022:5098
Red Hat Enterprise Linux BaseOS EUS (v. 8.2)Fixed RHSA-2022:5100
Red Hat Enterprise Linux BaseOS EUS (v.8.4)Fixed RHSA-2022:5096
Not affected: 9 products
  • Red Hat CodeReady Linux Builder (v. 9)
  • Red Hat CodeReady Linux Builder EUS (v. 8.2)
  • Red Hat Enterprise Linux BaseOS (v. 8)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.1)
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2)
  • Red Hat Enterprise Linux BaseOS EUS (v.8.4)
  • Red Hat Enterprise Linux CRB (v. 8)
  • Red Hat Enterprise Linux CRB EUS (v.8.4)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28734
  2. 2026-10-03 Alias added: GHSA-h8v2-pvw7-3jf5

References

Advisory 3

  • TI-2023-04324 Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution CVSS 3.1HIGH 7.8
  • TI-2015-06891 Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate… CVSS 3.1HIGH 7.4
  • TI-2024-37620 Heap-based buffer overflow in GNU GRUB2 CVSS 3.1HIGH 8.8
  • TI-2022-11367 Integer underflow in GNU GRUB CVSS 3.1HIGH 8.1
  • TI-2022-02403 Heap-based buffer overflow in grub2 CVSS 3.1HIGH 8.6
  • TI-2020-08612 Buffer overflow in Grub CVSS 3.1HIGH 8.2
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences