When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grub2-ppc64leUpgrade grub2-tools-extraUpgrade grub2-toolsUpgrade grub2-efi-x64-cdbootUpgrade grub2-efi-ia32Upgrade grub2-efi-ia32-modulesUpgrade grub2-tools-minimalUpgrade grub2-efi-ia32-cdbootUpgrade grub2-efi-x64Upgrade grub2-commonUpgrade grub2-pcUpgrade grub2-efi-aa64-modules | Jan 12, 2023 | Dec 19, 2022 |
| Amazon Linux Ami 2 | — | Upgrade grub2-emuUpgrade grub2-efi-x64-cdbootUpgrade grub2-debuginfoUpgrade grub2-tools-efiUpgrade grub2-efi-aa64Upgrade grub2-emu-modulesUpgrade grub2-efi-aa64-cdbootUpgrade grub2-efi-aa64-modulesUpgrade grub2-efi-x64-ec2Upgrade grub2-efi-x64-modulesUpgrade grub2-pc-modulesUpgrade grub2-toolsUpgrade grub2Upgrade grub2-commonUpgrade grub2-tools-minimalUpgrade grub2-pcUpgrade grub2-efi-x64Upgrade grub2-tools-extraUpgrade grub2-efi-aa64-ec2 | Jul 21, 2023 | Dec 19, 2022 |
| Amazon_linux_2023 | — | Upgrade grub2-efi-aa64-cdbootUpgrade grub2-emu-debuginfoUpgrade grub2-tools-efiUpgrade grub2-tools-extraUpgrade grub2-pc-modulesUpgrade grub2-efi-aa64-ec2Upgrade grub2-efi-aa64-modulesUpgrade grub2-efi-x64-modulesUpgrade grub2-emu-modulesUpgrade grub2-efi-aa64Upgrade grub2-efi-x64-ec2Upgrade grub2-tools-debuginfoUpgrade grub2-tools-extra-debuginfoUpgrade grub2-commonUpgrade grub2-tools-efi-debuginfoUpgrade grub2-pcUpgrade grub2-debugsourceUpgrade grub2-efi-x64-cdbootUpgrade grub2-tools-minimal-debuginfoUpgrade grub2-emuUpgrade grub2-efi-x64Upgrade grub2-toolsUpgrade grub2-debuginfoUpgrade grub2-tools-minimal | Feb 17, 2025 | Nov 15, 2022 |
| Centos_linux | — | Upgrade grub2-toolsUpgrade grub2-efi-x64Upgrade grub2-efi-x64-cdbootUpgrade grub2-ppc64le-modulesUpgrade grub2-efi-ia32-modulesUpgrade grub2-tools-minimal-debuginfoUpgrade grub2-debuginfoUpgrade grub2-debugsourceUpgrade grub2-tools-minimalUpgrade grub2-tools-debuginfoUpgrade grub2-pcUpgrade grub2-efi-ia32Upgrade grub2-commonUpgrade grub2-tools-extra-debuginfoUpgrade grub2-efi-aa64-modulesUpgrade grub2-pc-modulesUpgrade grub2-tools-efiUpgrade grub2-tools-extraUpgrade grub2-tools-efi-debuginfoUpgrade grub2-efi-x64-modulesUpgrade grub2-emu-debuginfoUpgrade grub2-efi-ia32-cdboot | Jan 12, 2023 | Dec 19, 2022 |
| Debian | — | Upgrade grub2 | Nov 17, 2022 | Nov 17, 2022 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Gentoo Linux | — | Upgrade sys-boot/grub. | Nov 27, 2023 | Dec 19, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade grub2-efi-x64Upgrade grub2-pcUpgrade grub2-toolsUpgrade grub2-tools-extraUpgrade grub2-tools-efiUpgrade grub2-tools-minimalUpgrade grub2-commonUpgrade grub2-efi-x64-modulesUpgrade grub2-pc-modules | Feb 13, 2023 | Dec 19, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade grub2-tools-extraUpgrade grub2-tools-efiUpgrade grub2-tools-minimalUpgrade grub2-pc-modulesUpgrade grub2-efi-x64Upgrade grub2-pcUpgrade grub2-efi-x64-modulesUpgrade grub2-toolsUpgrade grub2-common | Mar 8, 2023 | Dec 19, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade grub2-commonUpgrade grub2-efi-aa64-cdbootUpgrade grub2-tools-extraUpgrade grub2-efi-aa64-modulesUpgrade grub2-efi-aa64Upgrade grub2-tools-minimalUpgrade grub2-tools | Apr 13, 2023 | Dec 19, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade grub2-pcUpgrade grub2-efi-x64-modulesUpgrade grub2-pc-modulesUpgrade grub2-efi-x64Upgrade grub2-tools-extraUpgrade grub2-commonUpgrade grub2-toolsUpgrade grub2-tools-efiUpgrade grub2-tools-minimal | Mar 9, 2023 | Dec 19, 2022 |
| Msft | — | 2024-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB5041578)2024-08 Cumulative Update for Microsoft Windows Server 2012 R2 (KB5041828)2024-08 Cumulative Update for Microsoft Windows 10, version 21H2 (KB5041580)2024-08 Cumulative Update for Microsoft Windows Server 2022, version 22H2 (KB5041160)2024-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB5041773)2024-08 Cumulative Update for Microsoft Windows 11, version 22H2 (KB5041585)2024-08 Cumulative Update for Microsoft Windows Server 2022, version 21H2 (KB5041160)2024-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB5041578)2024-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB5041773)2024-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB5041782)2024-08 Cumulative Update for Microsoft Windows 11, version 23H2 (KB5041585)2024-08 Cumulative Update for Microsoft Windows 10, version 22H2 (KB5041580)2024-08 Cumulative Update for Microsoft Windows 11, version 24H2 (KB5041571)2024-08 Cumulative Update for Microsoft Windows 11, version 21H2 (KB5041592)2024-08 Cumulative Update for Microsoft Windows Server 2022, version 23H2 (KB5041573)2024-08 Cumulative Update for Microsoft Windows Server 2012 (KB5041851) | Aug 13, 2024 | Aug 13, 2024 |
| Oracle_linux | — | Upgrade grub2-pcUpgrade grub2-efi-x64-modulesUpgrade grub2-efi-aa64Upgrade grub2-efi-aa64-cdbootUpgrade grub2-efi-aa64-modulesUpgrade grub2-pc-modulesUpgrade grub2-commonUpgrade grub2-tools-efiUpgrade grub2-toolsUpgrade grub2-efi-ia32-modulesUpgrade grub2-efi-x64-cdbootUpgrade grub2-tools-minimalUpgrade grub2-efi-x64Upgrade grub2-efi-ia32Upgrade grub2-tools-extraUpgrade grub2-efi-ia32-cdboot | Jan 13, 2023 | Nov 15, 2022 |
| Redhat_linux | — | Upgrade grub2-tools-minimal-debuginfoUpgrade grub2-toolsUpgrade grub2-ppc64le-modulesUpgrade grub2-pcUpgrade grub2-efi-ia32-cdbootUpgrade grub2-efi-ia32-modulesUpgrade grub2-commonUpgrade grub2-efi-x64Upgrade grub2-efi-x64-modulesUpgrade grub2-tools-debuginfoUpgrade grub2-debuginfoNo solution existsUpgrade grub2-emu-debuginfoUpgrade grub2-tools-minimalUpgrade grub2-tools-extra-debuginfoUpgrade grub2-tools-extraUpgrade grub2-pc-modulesUpgrade grub2-efi-ia32Upgrade grub2-tools-efiUpgrade grub2-efi-x64-cdbootUpgrade grub2-debugsourceUpgrade grub2-efi-aa64-modulesUpgrade grub2-tools-efi-debuginfo | Dec 14, 2022 | Dec 13, 2022 |
| Rocky_linux | — | Upgrade grub2-efi-ia32Upgrade grub2-tools-debuginfoUpgrade grub2-efi-x64-cdbootUpgrade grub2-tools-extra-debuginfoUpgrade grub2-efi-ia32-cdbootUpgrade grub2-tools-minimalUpgrade grub2-efi-x64Upgrade grub2-tools-efi-debuginfoUpgrade grub2-tools-minimal-debuginfoUpgrade grub2-tools-extraUpgrade grub2-debugsourceUpgrade grub2-tools-efiUpgrade grub2-toolsUpgrade grub2-debuginfoUpgrade grub2-pc | Mar 12, 2024 | Dec 19, 2022 |
| Suse | — | Upgrade grub2-arm64-efiUpgrade grub2-x86_64-xenUpgrade grub2-s390x-emu-debugUpgrade grub2Upgrade grub2-branding-upstreamUpgrade grub2-x86_64-efi-debugUpgrade grub2-x86_64-efiUpgrade grub2-powerpc-ieee1275-debugUpgrade grub2-powerpc-ieee1275Upgrade grub2-systemd-sleep-pluginUpgrade grub2-i386-pc-debugUpgrade grub2-arm64-efi-debugUpgrade grub2-snapper-pluginUpgrade grub2-i386-pcUpgrade grub2-s390x-emu | Nov 22, 2022 | Nov 21, 2022 |
| Ubuntu | — | Upgrade grub-efi-amd64Upgrade grub-efi-arm64-signedUpgrade grub-efi-amd64-signedUpgrade shimUpgrade grub-efi-arm64-binUpgrade shim-signedUpgrade grub-efi-arm64Upgrade grub-efi-amd64-bin | Sep 18, 2023 | Dec 19, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 19, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub