Integer underflow in grub_net_recv_ip4_packets

CVE-2022-28733

Summary

An integer underflow vulnerability exists in GRUB's grub_net_recv_ip4_packets function, which can be exploited through maliciously crafted IP packets. When such a packet is received, the function may mistakenly interpret the total length value, causing it to wrap around to a smaller integer. This miscalculation can result in incorrect memory allocation, allowing attackers to write data beyond the allocated buffer, potentially leading to various security implications such as data corruption or unauthorized access.

References