Stay Secure with the Latest Linux Advisories

security advisorybuffer overflowmoderate severity

Red Hat: RHSA-2022-8978-01 Moderate: Grub2 Buffer Overflow and Heap Issues

An update for grub2 is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: grub2 security and bug fix update Advisory ID: RHSA-2022:8978-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:8978 Issue date: 2022-12-13 CVE Names: CVE-2022-2601 CVE-2022-3775 ==================================================================== 1. Summary: An update for grub2 is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS EUS (v.9.0) - aarch64, noarch, ppc64le, x86_64 3. Description: The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Security Fix(es): * grub2: Buffer overflow in grub_font_construct_glyph() can lead to out-of-bound write and possible secure boot bypass (CVE-2022-2601) * grub2: Heap based out-of-bounds write when redering certain unicode sequences (CVE-2022-3775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Kernel Panic on Milan when enableSEV/SEV-ES with CPU: 1 PID: 1 Comm: swapper/0 Not tainted (BZ#2130104) * [RHEL9.0][SecureBoot][Denali/P10] boot process stops at grub prompt after copying the signed grub to prep partition (BZ#2134358) * RHEL9.0 [MAXconfig]: Denali LPAR crashs while booting MAX config 240c / 64TB - 192 decimal is the biggest partition min value Linux can handle? (BZ#2134434) * ISST-LTE:[P10]:RPT:After FW update,while activating the lpar dexlp87 went to ERROR state with LED B2008105 - 7E sub return code (BZ#2135288) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2112975 - CVE-2022-2601 grub2: Buffer overflow in grub_font_construct_glyph() can lead to out-of-bound write and possible secure boot bypass 2138880 - CVE-2022-3775 grub2: Heap based out-of-bounds write when redering certain unicode sequences 6. Package List: Red Hat Enterprise Linux BaseOS EUS(v.9.0): Source: grub2-2.06-27.el9_0.12.src.rpm aarch64: grub2-debuginfo-2.06-27.el9_0.12.aarch64.rpm grub2-debugsource-2.06-27.el9_0.12.aarch64.rpm grub2-efi-aa64-2.06-27.el9_0.12.aarch64.rpm grub2-efi-aa64-cdboot-2.06-27.el9_0.12.aarch64.rpm grub2-emu-debuginfo-2.06-27.el9_0.12.aarch64.rpm grub2-tools-2.06-27.el9_0.12.aarch64.rpm grub2-tools-debuginfo-2.06-27.el9_0.12.aarch64.rpm grub2-tools-extra-2.06-27.el9_0.12.aarch64.rpm grub2-tools-extra-debuginfo-2.06-27.el9_0.12.aarch64.rpm grub2-tools-minimal-2.06-27.el9_0.12.aarch64.rpm grub2-tools-minimal-debuginfo-2.06-27.el9_0.12.aarch64.rpm noarch: grub2-common-2.06-27.el9_0.12.noarch.rpm grub2-efi-aa64-modules-2.06-27.el9_0.12.noarch.rpm grub2-efi-x64-modules-2.06-27.el9_0.12.noarch.rpm grub2-pc-modules-2.06-27.el9_0.12.noarch.rpm grub2-ppc64le-modules-2.06-27.el9_0.12.noarch.rpm ppc64le: grub2-debuginfo-2.06-27.el9_0.12.ppc64le.rpm grub2-debugsource-2.06-27.el9_0.12.ppc64le.rpm grub2-ppc64le-2.06-27.el9_0.12.ppc64le.rpm grub2-tools-2.06-27.el9_0.12.ppc64le.rpm grub2-tools-debuginfo-2.06-27.el9_0.12.ppc64le.rpm grub2-tools-extra-2.06-27.el9_0.12.ppc64le.rpm grub2-tools-extra-debuginfo-2.06-27.el9_0.12.ppc64le.rpm grub2-tools-minimal-2.06-27.el9_0.12.ppc64le.rpm grub2-tools-minimal-debuginfo-2.06-27.el9_0.12.ppc64le.rpm x86_64: grub2-debuginfo-2.06-27.el9_0.12.x86_64.rpm grub2-debugsource-2.06-27.el9_0.12.x86_64.rpm grub2-efi-x64-2.06-27.el9_0.12.x86_64.rpm grub2-efi-x64-cdboot-2.06-27.el9_0.12.x86_64.rpm grub2-emu-debuginfo-2.06-27.el9_0.12.x86_64.rpm grub2-pc-2.06-27.el9_0.12.x86_64.rpm grub2-tools-2.06-27.el9_0.12.x86_64.rpm grub2-tools-debuginfo-2.06-27.el9_0.12.x86_64.rpm grub2-tools-efi-2.06-27.el9_0.12.x86_64.rpm grub2-tools-efi-debuginfo-2.06-27.el9_0.12.x86_64.rpm grub2-tools-extra-2.06-27.el9_0.12.x86_64.rpm grub2-tools-extra-debuginfo-2.06-27.el9_0.12.x86_64.rpm grub2-tools-minimal-2.06-27.el9_0.12.x86_64.rpm grub2-tools-minimal-debuginfo-2.06-27.el9_0.12.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details onhow to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-2601 https://access.redhat.com/security/cve/CVE-2022-3775 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY5j9/NzjgjWX9erEAQjbZQ//a/froDILL6ZRBqxuscAjkZrWUPfPWEzw m7mLmI0/hIhR5bREv03E0PoLEhRFQrB0eggfcc1lOQGcNCDTazvuUsSaBU1ULUHV TVDcoTRPQl/NRnlfGPFvCn9Yz2rWYx9rkeI+rmHD7JBNewYDY1WdA/mmxp9RvV0X fxDtwLPfO7PauAe23oCJdmZh1GypZbk3nfS4unkYyu/PLPKiB+MMN/bpAjIqwrML xzwc/b/hVmJz3xg5qh+5/2+0P3Oug4hND72JZBYAtbuycCtEHzm29VoNMOOi+P9E ApJBiF/V9qyndwFKqi9pyyNtv5naRCcGdYdnUFRaknjF0DKxIsXBs+K1FREtiTDo LDXOUuLFe0KYPzY4sD9AMRaikuQWmV5oC0BE7w9bPvuFtXBSttwXkqHJ0D5kt0Da PRAXsIfcww0XV91LCui77mrjUPOlIfR0XfxMUrMdde0TJnnTi54DCNM0NJLKmoVV 83DQqi8Ln1xq+zG78muAgsLCwpB2tL45iyRzD6esZ3VlMbH6sDsOABKNZxJPD+UL MCPcvO2ypEBGSH/kppTU/SvKN2ijFPM2ZhV15UX4zI+TcAq1YKoQAdjwAqN39Ksk KVRCqno6wJbKREWTijUUM0x7XiLQB+gJ2Z869F6cXxaJ4teY7DprTQQ2xMKbz/lr KJfj48QotlU=A8i1 -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Debian enhances initramfs-tools addressing serious vulnerabilities related to memory corruption and race conditions. Crucial for improved system startup security.. Red Hat Security, Grub2 Update, Boot Loader Security, Linux Enterprise, Moderate Severity Advisory. . LinuxSecurity.com Team

Dec 13, 2022 Red Hat