Buffer Overflow in GRUB Affects Secure Boot Mechanism

CVE-2022-2601

What is CVE-2022-2601?

A buffer overflow vulnerability in the GRUB bootloader was identified, where a maliciously crafted pf2 font could exploit the function grub_font_construct_glyph(). This issue arises during the calculation of max_glyph_size, leading to the allocation of insufficient buffer space. Consequently, this flaw can cause a buffer overflow and result in a heap-based out-of-bounds write. Attackers may leverage this vulnerability to bypass the secure boot process, potentially compromising system integrity.

References