RLSA-2022:5095

See a problem?
Import Source
https://storage.googleapis.com/resf-osv-data/RLSA-2022:5095.json
JSON Data
https://api.osv.dev/v1/vulns/RLSA-2022:5095
Related
Published
2022-06-16T13:10:10Z
Modified
2023-02-02T12:53:46.144435Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Important: grub2, mokutil, shim, and shim-unsigned-x64 security update
Details

The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.

The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.

Security Fix(es):

  • grub2: Integer underflow in grubnetrecvip4packets (CVE-2022-28733)

  • grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)

  • grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)

  • grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)

  • grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)

  • grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)

  • grub2: use-after-free in grubcmdchainloader() (CVE-2022-28736)

  • shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References
Credits
    • Rocky Enterprise Software Foundation
    • Red Hat

Affected packages

Rocky Linux:8 / grub2

Package

Name
grub2
Purl
pkg:rpm/rocky-linux/grub2?distro=rocky-linux-8-6-legacy&epoch=1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:2.02-123.el8_6.8

Rocky Linux:8 / mokutil

Package

Name
mokutil
Purl
pkg:rpm/rocky-linux/mokutil?distro=rocky-linux-8-6-legacy&epoch=1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:0.3.0-11.el8_6.1

Rocky Linux:8 / shim

Package

Name
shim
Purl
pkg:rpm/rocky-linux/shim?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0:15.6-1.el8

Rocky Linux:8 / shim-unsigned-x64

Package

Name
shim-unsigned-x64
Purl
pkg:rpm/rocky-linux/shim-unsigned-x64?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0:15.6-1.el8