CVE-2022-28736

There's a use-after-free vulnerability in grubcmdchainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved.

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-28736.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "2.00"
            },
            {
                "fixed": "2.06-3"
            }
        ]
    }
]