CVE-2022-28733: Integer underflow in grub_net_recv_ip4_packets
A flaw was found in grub2 when handling IPv4 packets. This flaw allows an attacker to craft a malicious packet, triggering an integer underflow in grub code. Consequently, the memory allocation for handling the packet data may be smaller than the size needed. This issue causes an out-of-bands write during packet handling, compromising data integrity, confidentiality issues, a denial of service, and remote code execution.
Other sources
A malicious crafted IP packet can lead to a integer underflow in grubnetrecvip4packets() function on rsm->totallen value. Under certain circumstances the totallen value may ending up wrapping around to a small integer number which will be used in memory allocation. If the attack succeeds in such way, subsequent operations can write past the end of the buffer.
— Red Hat
Integer underflow in grubnetrecvip4packets; A malicious crafted IP packet can lead to an integer underflow in grubnetrecvip4packets() function on rsm->totallen value. Under certain circumstances the totallen value may end up wrapping around to a small integer number which will be used in memory allocation. If the attack succeeds in such way, subsequent operations can write past the end of the buffer.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2022-28733.
How does this vulnerability affect the affected software?
This vulnerability affects the affected software by allowing an attacker to craft a malicious packet that triggers an integer underflow in the grub code.
What is the severity of CVE-2022-28733?
The severity of CVE-2022-28733 is high with a CVSSv3 score of 8.1.
What is the recommended remedy for this vulnerability?
The recommended remedy for this vulnerability is to update the affected software to version 1:2.02-0.87.el7_9.11 for Red Hat, 1:2.02-123.el8_6.8 for Red Hat, and 1:2.02-87.el8_1.10 for Red Hat, among others.
Where can I find more information about CVE-2022-28733?
You can find more information about CVE-2022-28733 on the MITRE CVE website, the NVD website, and the Openwall mailing list.