CVE-2022-3775

Multiple integer underflows in Grub2 versions 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the grub_username_get and grub_password_get functions.

A Use After Free vulnerability has been identified in the GRUB2 bootloader's normal module. The flaw occurs because the normal_exit command is not properly unregistered when its module is unloaded. An attacker can invoke the command after module removal, causing access to freed memory.

A Use-after-Free vulnerability has been found in the GRUB2 bootloader's 'normal' command. The flaw occurs because the command is not properly unregistered when the module is unloaded, allowing an attacker to access invalid memory locations. Successful exploitation leads to system instability and a complete crash.

A Use-after-Free vulnerability has been found in the GRUB2 bootloader's network module. The flaw is caused by improper unregistration of the net_set_vlan command when the module is unloaded from memory. An attacker can exploit this to cause system instability and a complete crash.

A flaw in the romfs module of GRUB2 allows integer overflow during buffer size calculation based on user-controlled filesystem geometry parameters. A crafted filesystem can cause a smaller-than-expected buffer allocation, leading to out-of-bounds writes in grub_romfs_read_symlink() and potentially arbitrary code execution.

A buffer overflow vulnerability was found in the jfs filesystem module of GRUB2. The grub_jfs_lookup_symlink() function writes beyond the allocated buffer when a specially crafted jfs filesystem is used. This can corrupt critical internal GRUB data and potentially lead to arbitrary code execution.

A flaw in GRUB2's reiserfs module allows integer overflow during symlink buffer size calculation, leading to heap out-of-bounds write and potential arbitrary code execution.

A flaw in GRUB2's squash4 module improperly checks integer overflows when determining internal buffer sizes from filesystem geometry. A crafted filesystem can cause a smaller buffer allocation, leading to a heap-based out-of-bounds write during data reading. This could allow arbitrary code execution and bypass Secure Boot protections.

A stack overflow vulnerability was found in the BFS file system support in GRUB2. A crafted BFS filesystem image can trigger an uncontrolled loop, causing GRUB2 to crash.

A flaw was found in grub2 when reading tar files. The function allocating a buffer for the file name does not properly check for integer overflows, which can lead to a heap out-of-bounds write. This allows an attacker to bypass secure boot protections.