8.6
Élevée
CVE-2022-2601 A buffer overflow was found in grub_font_construct_glyph()
Description
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| grub2 | Versions non publiées |
Références
- bugzilla.redhat.com bugzilla.redhat.com
- security.netapp.com security.netapp.com
- GLSA-202311-14 security.gentoo.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de grub2
Les 14 CVE de grub2 →
CVE-2022-3775
When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and…
7.1
Élevée
CVE-2021-3697
A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written…
Non notée
CVE-2021-3696
A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader
Non notée
CVE-2021-3695
A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area
Non notée