CVE-2022-2601

Description

A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.

Affected products

Vendor	Product	Affected	Fixed
—	grub2	grub2 2.06 and lower	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	grub2	2.06-5	—
Debian 13	grub2	2.06-5	—
Debian 12	grub2	2.06-5	—
Debian 11	grub2	2.06-3~deb11u4	DSA-5280-1
Debian 10	grub2	2.06-3~deb10u2	DLA-3190-2, DLA-3190-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	grub2-signed	1.187.3~22.04.1	—
Ubuntu 22.04 LTS	grub2-unsigned	2.06-2ubuntu14.1	—
Ubuntu 20.04 LTS	grub2-signed	1.187.3~20.04.1	—
Ubuntu 20.04 LTS	grub2-unsigned	2.06-2ubuntu14.1	—
Ubuntu 18.04 LTS	grub2-signed	1.187.3~18.04.1	—
Ubuntu 18.04 LTS	grub2-unsigned	2.06-2ubuntu14.1	—
Ubuntu 16.04 LTS	grub2-signed +1	No fix yet	—

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 14.04 LTS	grub2-signed	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	grub2 +15	1:2.06-46.el9_1.3	RHSA-2023:0752
RHEL 8	grub2 +18	1:2.02-142.el8_7.1	RHSA-2023:0049
RHEL 7	grub2 +18	1:2.02-0.87.el7_9.14	RHSA-2024:2002

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 9.0 EUS	grub2 +15	1:2.06-27.el9_0.12	RHSA-2022:8978
RHEL 8.6 EUS	grub2 +18	1:2.02-123.el8_6.12	RHSA-2023:0048
RHEL 8.4 EUS	grub2 +18	1:2.02-99.el8_4.10	RHSA-2023:0047
RHEL 8.2 TUS	grub2 +15	1:2.02-87.el8_2.11	RHSA-2022:8800
RHEL 8.2 E4S	grub2 +16	1:2.02-87.el8_2.11	RHSA-2022:8800
RHEL 8.2 AUS	grub2 +15	1:2.02-87.el8_2.11	RHSA-2022:8800
RHEL 8.1 E4S	grub2 +16	1:2.02-87.el8_1.11	RHSA-2022:8494

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	grub2-pc +14	1:2.06-46.el9_1.3.alma	ALSA-2023:0752
AlmaLinux 8	grub2-pc +17	1:2.02-142.el8_7.1.alma	ALSA-2023:0049

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	grub2	1:2.06-46.el9_1.3.rocky.0.2	RLSA-2023:0752
Rocky Linux 8	grub2	1:2.02-142.el8_7.1.rocky.0.2	RLSA-2023:0049

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	grub2	2.06-150400.11.17.1	SUSE-SU-2022:4141-1
SLES 15 SP3	grub2	2.04-150300.22.25.1	SUSE-SU-2022:4219-1
SLES 15 SP2	grub2	2.04-150200.9.68.1	SUSE-SU-2022:4218-1
SLES 15 SP1	grub2	2.02-150100.123.17.1	SUSE-SU-2022:4142-1
SLES 15	grub2	2.02-150000.122.17.1	SUSE-SU-2022:4140-1

Show 24 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP5	grub2	2.02-153.1	SUSE-SU-2022:4302-1
SLES 12 SP4	grub2	2.02-153.1	SUSE-SU-2022:4302-1
SLES 12 SP3	grub2	2.02-142.1	SUSE-SU-2022:4143-1
SLES 12 SP2	grub2	2.02-115.72.1	SUSE-SU-2022:4144-1
SLES for SAP 15 SP2	grub2	2.04-150200.9.68.1	SUSE-SU-2022:4218-1
SLES for SAP 15 SP1	grub2	2.02-150100.123.17.1	SUSE-SU-2022:4142-1
SLES for SAP 15	grub2	2.02-150000.122.17.1	SUSE-SU-2022:4140-1
SLES for SAP 12 SP5	grub2	2.02-153.1	SUSE-SU-2022:4302-1
SLES for SAP 12 SP4	grub2	2.02-153.1	SUSE-SU-2022:4302-1
SLE Micro 5.3	grub2	2.06-150400.11.17.1	SUSE-SU-2022:4141-1
SLE Micro 5.2	grub2	2.04-150300.22.25.1	SUSE-SU-2022:4219-1
SLE Micro 5.1	grub2	2.04-150300.3.8.1	SUSE-SU-2023:1701-1
SLE HPC 15 SP2	grub2	2.04-150200.9.68.1	SUSE-SU-2022:4218-1
SLE HPC 15 SP1	grub2	2.02-150100.123.17.1	SUSE-SU-2022:4142-1
SLE HPC 15	grub2	2.02-150000.122.17.1	SUSE-SU-2022:4140-1
SUSE OpenStack Cloud Crowbar 9	grub2	2.02-153.1	SUSE-SU-2022:4302-1
SUSE OpenStack Cloud 9	grub2	2.02-153.1	SUSE-SU-2022:4302-1
SUSE Manager Server 4.1	grub2	2.04-150200.9.68.1	SUSE-SU-2022:4218-1
SUSE Manager Retail Branch Server 4.1	grub2	2.04-150200.9.68.1	SUSE-SU-2022:4218-1
SUSE Manager Proxy Module 4.3	grub2	2.06-150400.11.17.1	SUSE-SU-2022:4141-1
SUSE Manager Proxy Module 4.2	grub2	2.04-150300.22.25.1	SUSE-SU-2022:4219-1
SUSE Manager Proxy 4.1	grub2	2.04-150200.9.68.1	SUSE-SU-2022:4218-1
SUSE Enterprise Storage 7	grub2	2.04-150200.9.68.1	SUSE-SU-2022:4218-1
SUSE Enterprise Storage 6	grub2	2.02-150100.123.17.1	SUSE-SU-2022:4142-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	grub2	2.06-31.1	openSUSE-SU-2024:12517-1
openSUSE Leap 15.4	grub2	2.06-150400.11.17.1	SUSE-SU-2022:4141-1
openSUSE Leap 15.3	grub2	2.04-150300.22.25.1	SUSE-SU-2022:4219-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
openSUSE Leap Micro 5.3	grub2	2.06-150400.11.17.1	SUSE-SU-2022:4141-1
openSUSE Leap Micro 5.2	grub2	2.04-150300.22.25.1	SUSE-SU-2022:4219-1

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	grub2-pc +16	1:2.06-61.amzn2023.0.3	ALAS2023-2023-020
Amazon Linux 2	grub2 +17	1:2.06-14.amzn2	ALAS2-2023-2146

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	grub2	2.06-14	—
Azure Linux 2 (CBL-Mariner)	grub2	2.06-8	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	grub2-pc +12	1:2.06-46.0.4.el9	ELSA-2023-12019, ELSA-2023-0752
Oracle Linux 8	grub2-pc +15	1:2.02-142.0.3.el8_7.1	ELSA-2023-0049
Oracle Linux 7	grub2 +12	1:2.02-0.87.0.26.el7_9.14	ELSA-2024-2002

Advisories 38

ALSA-2023:0752 Moderate: grub2 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2023:0049 Moderate: grub2 security update AlmaLinux Security Advisories · Oct 29, 2026
WID-SEC-2024-3195 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
RHSA-2024:2002 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2023:0752 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · May 28, 2026
RHSA-2023:0048 Red Hat Security Advisory: grub2 security and bug fix update Red Hat Security Advisories (RHSA) · May 28, 2026
RHSA-2023:0049 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · May 28, 2026
RHSA-2023:0047 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · May 28, 2026
RHSA-2022:8978 Red Hat Security Advisory: grub2 security and bug fix update Red Hat Security Advisories (RHSA) · May 28, 2026
RHSA-2022:8494 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · May 28, 2026
RHSA-2022:8800 Red Hat Security Advisory: grub2 security update Red Hat Security Advisories (RHSA) · May 28, 2026
WID-SEC-2022-2058 Grub2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 7, 2026
DSA-5280-1 grub2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3190-1 grub2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3190-2 grub2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
RLSA-2023:0049 Moderate: grub2 security update Rocky Linux Security Advisories · Feb 5, 2026
RLSA-2023:0752 Moderate: grub2 security update Rocky Linux Security Advisories · Feb 4, 2026
openSUSE-SU-2024:12517-1 grub2-2.06-31.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:4140-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:4143-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:4302-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:4218-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2023:1701-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:4142-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:4144-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:4141-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2025-0225 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2025
SUSE-SU-2022:4219-1 Security update for grub2 SUSE / openSUSE Security Updates · May 2, 2025
NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
NCSC-2024-0334 Kwetsbaarheden verholpen in Microsoft Windows NCSC-NL (Netherlands) · Aug 27, 2024
WID-SEC-2024-1835 Microsoft Windows: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2024
NCSC-2024-0339 Kwetsbaarheden verholpen in Microsoft Mariner NCSC-NL (Netherlands) · Aug 13, 2024
ELSA-2024-2002 Moderate: grub2 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · May 1, 2024
ALAS2-2023-2146 Important: grub2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 19, 2023
ELSA-2023-0752 Moderate: grub2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 13, 2023
ALAS2023-2023-020 Important: grub2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
ELSA-2023-0049 Moderate: grub2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 25, 2023
ELSA-2023-12019 Important: grub2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jan 12, 2023

EUVD	v3.1	8.6
CISA-ADP	v3.1	8.6

A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_g…

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Amazon Linux

Azure Linux

Oracle Linux

Advisories 38

References