GRUB Bootloader Misconfiguration in Fedora CoreOS
CVE-2022-3675

2.6LOW

Key Information:

Vendor

Fedora Project

Status
Coreos
Vendor
CVE Published:
3 November 2022

What is CVE-2022-3675?

In recent versions of Fedora CoreOS, a misconfiguration in the GRUB bootloader allows users to boot non-default OSTree deployments without requiring a password. This vulnerability allows individuals with access to the GRUB menu to revert the system to an earlier version, potentially negating crucial security fixes applied in the latest updates. It’s important to note that while the boot process can be bypassed without a password, a password is still necessary to modify kernel command-line arguments and access the GRUB command line.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

CoreOS testing 36.20220906.2.0 and later

CoreOS next 36.20220906.1.0 and later

CoreOS stable 36.20220820.3.0 and later

References

https://github.com/coreos/fedora-coreos-tracker/issues/1333
issue-tracking
https://lists.fedoraproject.org/archives/list/coreos-stat...
release-notes
https://docs.fedoraproject.org/en-US/fedora-coreos/grub-p...
related

CVSS V3.1

Score:
2.6
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.