CVE-2022-3775
- ULN >
- Oracle Linux CVE repository >
- CVE-2022-3775
CVE Details
| Release Date: | 2022-12-19 | |
| Impact: | None | What is this? |
Description
When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.
See more information about CVE-2022-3775 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 metrics
| Base Score: | 7.1 |
| Vector String: | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
| Version: | 3.0 |
| Attack Vector: | Local |
| Attack Complexity: | Low |
| Privileges Required: | Low |
| User Interaction: | None |
| Scope: | Unchanged |
| Confidentiality Impact: | None |
| Integrity Impact: | High |
| Availability Impact: | High |
Errata information
| Platform | Errata | Release Date |
| Oracle Linux version 8 (grub2) | ELSA-2023-0049 | 2023-01-25 |
| Oracle Linux version 9 (grub2) | ELSA-2023-0752 | 2023-06-13 |
| Oracle Linux version 9 (grub2) | ELSA-2023-12019 | 2023-01-12 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections:
- Oracle customers - enter a support request
- Vulnerability scanning tools vendors and project maintainers - follow the standard ISV process
