CVE-2022-28734: Out-of-bounds write when handling split HTTP headers
A flaw was found in grub2 when handling split HTTP headers. While processing a split HTTP header, grub2 wrongly advances its control pointer to the internal buffer by one position, which can lead to an out-of-bounds write. This flaw allows an attacker to leverage this issue by crafting a malicious set of HTTP packages making grub2 corrupt its internal memory metadata structure. This leads to data integrity and confidentiality issues or forces grub to crash, resulting in a denial of service attack.
Other sources
Out-of-bounds write when handling split HTTP headers
— Microsoft
When handling split HTTP headers, grub2 HTTP code accidentally its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NULL byte past the buffer. It's conceivable that an attacker controlled set of packets can lead to corruption of the grub's internal memory metadata
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-28734?
CVE-2022-28734 is a vulnerability in grub2 that allows an attacker to perform an out-of-bounds write due to an issue handling split HTTP headers.
What is the severity of CVE-2022-28734?
CVE-2022-28734 has a severity rating of 9.8 (Critical).
Which software is affected by CVE-2022-28734?
CVE-2022-28734 affects the following software versions: Red Hat grub2 1:2.02-123.el8_6.8, Red Hat grub2 1:2.02-87.el8_1.10, Red Hat grub2 1:2.02-87.el8_2.10, Red Hat grub2 1:2.02-99.el8_4.9, Red Hat grub2 1:2.06-27.el9_0.7, Red Hat grub 2.12, Gnu Grub2 2.00 to 2.06-3, Ubuntu grub2 2.06-3, Debian grub2 2.06-3~deb10u1, 2.06-3~deb10u3, 2.06-3~deb11u5, 2.06-3~deb11u4, 2.06-13, and 2.12~rc1-9.
How can an attacker exploit CVE-2022-28734?
An attacker can exploit CVE-2022-28734 by crafting a malicious request containing split HTTP headers that trigger an out-of-bounds write in grub2, potentially leading to remote code execution or denial of service.
How can I fix CVE-2022-28734?
To fix CVE-2022-28734, it is recommended to update the affected software versions to the specified remedies: Red Hat grub2 1:2.02-123.el8_6.8, Red Hat grub2 1:2.02-87.el8_1.10, Red Hat grub2 1:2.02-87.el8_2.10, Red Hat grub2 1:2.02-99.el8_4.9, Red Hat grub2 1:2.06-27.el9_0.7, Red Hat grub 2.12, Gnu Grub2 2.06-3, Ubuntu grub2 2.06-3, Debian grub2 2.06-3~deb10u1, 2.06-3~deb10u3, 2.06-3~deb11u5, 2.06-3~deb11u4, 2.06-13, and 2.12~rc1-9.