vulnerability
CentOS Linux: CVE-2022-28733: Important: grub2, mokutil, shim, and shim-unsigned-x64 security update (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:M/Au:N/C:C/I:C/A:C) | 2022-06-16 | 2022-06-17 | 2025-01-28 |
Severity
9
CVSS
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
Published
2022-06-16
Added
2022-06-17
Modified
2025-01-28
Description
Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a small integer number which will be used in memory allocation. If the attack succeeds in such way, subsequent operations can write past the end of the buffer.
Solution(s)
centos-upgrade-grub2centos-upgrade-grub2-commoncentos-upgrade-grub2-debuginfocentos-upgrade-grub2-debugsourcecentos-upgrade-grub2-efi-aa64-modulescentos-upgrade-grub2-efi-ia32centos-upgrade-grub2-efi-ia32-cdbootcentos-upgrade-grub2-efi-ia32-modulescentos-upgrade-grub2-efi-x64centos-upgrade-grub2-efi-x64-cdbootcentos-upgrade-grub2-efi-x64-modulescentos-upgrade-grub2-emu-debuginfocentos-upgrade-grub2-pccentos-upgrade-grub2-pc-modulescentos-upgrade-grub2-ppc-modulescentos-upgrade-grub2-ppc64-modulescentos-upgrade-grub2-ppc64le-modulescentos-upgrade-grub2-toolscentos-upgrade-grub2-tools-debuginfocentos-upgrade-grub2-tools-eficentos-upgrade-grub2-tools-efi-debuginfocentos-upgrade-grub2-tools-extracentos-upgrade-grub2-tools-extra-debuginfocentos-upgrade-grub2-tools-minimalcentos-upgrade-grub2-tools-minimal-debuginfocentos-upgrade-mokutilcentos-upgrade-mokutil-debuginfocentos-upgrade-mokutil-debugsourcecentos-upgrade-shim-ia32centos-upgrade-shim-x64
References
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.