What is the severity of CVE-2022-3675?

CVE-2022-3675 has a moderate severity level due to its impact on GRUB configuration in Fedora CoreOS.

How do I fix CVE-2022-3675?

To fix CVE-2022-3675, ensure that the GRUB bootloader password is correctly configured and verify that Butane configurations are applied properly.

Which versions of Fedora CoreOS are affected by CVE-2022-3675?

Fedora CoreOS versions between 36.20220820.3.0 and 37.20221031.1.0 are affected by CVE-2022-3675.

What is the impact of CVE-2022-3675?

The impact of CVE-2022-3675 includes the potential for unauthorized access to GRUB command-line and modification of boot parameters.

Is there a workaround for CVE-2022-3675?

A workaround for CVE-2022-3675 is to disable the GRUB password feature until a proper fix can be applied.

Vulnerability/
CVE-2022-3675

medium

5.5

CWE

306 20

3/11/2022

3/8/2024

CVE-2022-3675: Input Validation

First published: Thu Nov 03 2022(Updated: )

Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB command-line, modify kernel command-line arguments, or boot non-default OSTree deployments. Recent Fedora CoreOS releases have a misconfiguration which allows booting non-default OSTree deployments without entering a password. This allows someone with access to the GRUB menu to boot into an older version of Fedora CoreOS, reverting any security fixes that have recently been applied to the machine. A password is still required to modify kernel command-line arguments and to access the GRUB command line.

Credit: patrick@puiterwijk.org patrick@puiterwijk.org

Affected Software	Affected Version	How to fix
Redhat Fedora Coreos	>=36.20220820.3.0<37.20221031.1.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2022-3675?
CVE-2022-3675 has a moderate severity level due to its impact on GRUB configuration in Fedora CoreOS.
How do I fix CVE-2022-3675?
To fix CVE-2022-3675, ensure that the GRUB bootloader password is correctly configured and verify that Butane configurations are applied properly.
Which versions of Fedora CoreOS are affected by CVE-2022-3675?
Fedora CoreOS versions between 36.20220820.3.0 and 37.20221031.1.0 are affected by CVE-2022-3675.
What is the impact of CVE-2022-3675?
The impact of CVE-2022-3675 includes the potential for unauthorized access to GRUB command-line and modification of boot parameters.
Is there a workaround for CVE-2022-3675?
A workaround for CVE-2022-3675 is to disable the GRUB password feature until a proper fix can be applied.

collector/nvd-index
agent/author
agent/type
agent/softwarecombine
agent/weakness
agent/references
collector/nvd-api
agent/software-canonical-lookup-request
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/severity
agent/first-publish-date
agent/tags
agent/event
agent/description
agent/source
vendor/redhat
canonical/redhat fedora coreos
version/redhat fedora coreos/36.20220820.3.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2022-3675?
CVE-2022-3675 has a moderate severity level due to its impact on GRUB configuration in Fedora CoreOS.
How do I fix CVE-2022-3675?
To fix CVE-2022-3675, ensure that the GRUB bootloader password is correctly configured and verify that Butane configurations are applied properly.
Which versions of Fedora CoreOS are affected by CVE-2022-3675?
Fedora CoreOS versions between 36.20220820.3.0 and 37.20221031.1.0 are affected by CVE-2022-3675.
What is the impact of CVE-2022-3675?
The impact of CVE-2022-3675 includes the potential for unauthorized access to GRUB command-line and modification of boot parameters.
Is there a workaround for CVE-2022-3675?
A workaround for CVE-2022-3675 is to disable the GRUB password feature until a proper fix can be applied.