Red Hat Security Advisory: grub2, mokutil, shim, and shim-unsigned-x64 security update

Fixed packages 30

Vulnerabilities 8

• High 8.1
  CVE-2022-28733

  Integer underflow in grub_net_recv_ip4_packets

  Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a sma…

  GNU GNU GRUB grub2 grub2-signed Debian Ubuntu Azure Linux
  Jul 20, 2023
• High 8.1
  CVE-2022-28734

  Out-of-bounds write when handling split HTTP headers

  Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a N…

  GNU GNU GRUB grub2 grub2-signed Debian Ubuntu Azure Linux
  Jul 20, 2023
• Medium 6.7
  CVE-2022-28735

  The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such …

  GNU GNU GRUB grub2 grub2-signed Debian Ubuntu Azure Linux
  Jul 20, 2023
• Medium 6.5
  CVE-2022-28737

  There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables

  There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-b…

  Red Hat Bootloader Team shim shim shim-unsigned-x64 Debian Ubuntu Azure Linux
  Jul 20, 2023
• Medium 6.4
  CVE-2022-28736

  There's a use-after-free vulnerability in grub_cmd_chainloader() function

  There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-a…

  GNU GNU GRUB grub2 grub2-signed Debian Ubuntu Azure Linux
  Jul 20, 2023
• Unscored —
  CVE-2021-3695

  A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage…

  grub2 grub2-signed grub2-unsigned grub2 Debian Ubuntu Azure Linux
  Jul 6, 2022
• Unscored —
  CVE-2021-3696

  A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data co…

  grub2 grub2-signed grub2-unsigned grub2 Debian Ubuntu Azure Linux
  Jul 6, 2022
• Unscored —
  CVE-2021-3697

  A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be writte…

  grub2 grub2-signed grub2-unsigned grub2 Debian Ubuntu Azure Linux Alpine
  Jul 6, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1991685
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1991686
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1991687
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2083339
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2090463
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2090857
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2090899
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2092613
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5096.json
• report
  https://access.redhat.com/security/cve/CVE-2021-3695
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3695
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3695
• report
  https://access.redhat.com/security/cve/CVE-2021-3696
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3696
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3696
• report
  https://access.redhat.com/security/cve/CVE-2021-3697
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3697
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3697
• report
  https://access.redhat.com/security/cve/CVE-2022-28733
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-28733
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-28733
• report
  https://access.redhat.com/security/cve/CVE-2022-28734
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-28734
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-28734
• report
  https://access.redhat.com/security/cve/CVE-2022-28735
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-28735
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-28735
• report
  https://access.redhat.com/security/cve/CVE-2022-28736
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-28736
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-28736
• report
  https://access.redhat.com/security/cve/CVE-2022-28737
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-28737
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-28737