CVE-2022-2601: Buffer Overflow
A buffer overflow was found in grubfontconstructglyph(). A malicious crafted pf2 font can lead to an overflow when calculating the maxglyphsize value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.
Other sources
Redhat: CVE-2022-2601 grub2 - Buffer overflow in grubfontconstructglyph() can lead to out-of-bound write and possible secure boot bypass
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this buffer overflow?
The vulnerability ID is CVE-2022-2601.
What software is affected by CVE-2022-2601?
The affected software includes Gnu Grub2, Fedora 37, Redhat Enterprise Linux Eus, Redhat Enterprise Linux For Power Little Endian Eus, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions, Redhat Enterprise Linux Server Tus, Redhat Enterprise Linux Server Update Services For Sap Solutions.
What is the severity rating of CVE-2022-2601?
CVE-2022-2601 has a severity rating of 8.6 (high).
What are the Common Weakness Enumerations (CWE) associated with CVE-2022-2601?
The common weakness enumerations (CWE) associated with CVE-2022-2601 are CWE-119, CWE-122, and CWE-787.
Where can I find more information about CVE-2022-2601?
You can find more information about CVE-2022-2601 at the following references: [1](https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0), [2](https://security.netapp.com/advisory/ntap-20230203-0004/), [3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2142996).