CVE-2022-2601
A buffer overflow was found in grub_font_construct_glyph().
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.
- CVSS 3.1
- 8.6 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- EPSS
- 0.52% probability · 44th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-122, CWE-787
- Affected
- gnu/grub2 · fedoraproject/fedora · redhat/enterprise linux eus · redhat/enterprise linux for power little endian eus · redhat/enterprise linux server aus · redhat/enterprise linux server for power little endian update services for sap solutions · redhat/enterprise linux server tus · redhat/enterprise linux server update services for sap solutions
- Source
- secalert@redhat.com
EPSS 0.5% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0Issue Tracking, Third Party Advisory
- https://security.gentoo.org/glsa/202311-14
- https://security.netapp.com/advisory/ntap-20230203-0004/
- https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-linux-users/
- https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0Issue Tracking, Third Party Advisory
- https://security.gentoo.org/glsa/202311-14
- https://security.netapp.com/advisory/ntap-20230203-0004/
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.