CVE-2022-28736

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-28736", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2022-04-05T21:59:08.761Z", "datePublished": "2023-07-20T00:23:01.952Z", "dateUpdated": "2025-02-13T16:32:37.356Z"}, "containers": {"cna": {"affected": [{"packageName": "grub2", "product": "GNU GRUB", "vendor": "GNU Project", "repo": "https://git.savannah.gnu.org/cgit/grub.git", "platforms": ["Linux"], "versions": [{"lessThan": "2.06-3", "status": "affected", "version": "0", "versionType": "semver"}]}], "title": "There's a use-after-free vulnerability in grub_cmd_chainloader() function", "descriptions": [{"lang": "en", "value": "There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved."}], "datePublic": "2022-06-13T00:00:00.000Z", "references": [{"tags": ["mailing-list"], "url": "https://www.openwall.com/lists/oss-security/2022/06/07/5"}, {"tags": ["issue-tracking"], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28736"}, {"url": "https://security.netapp.com/advisory/ntap-20230825-0002/"}], "credits": [{"lang": "en", "type": "finder", "value": "Chris Coulson"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2023-08-25T22:06:14.346Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:03:52.084Z"}, "title": "CVE Program Container", "references": [{"tags": ["mailing-list", "x_transferred"], "url": "https://www.openwall.com/lists/oss-security/2022/06/07/5"}, {"tags": ["issue-tracking", "x_transferred"], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28736"}, {"url": "https://security.netapp.com/advisory/ntap-20230825-0002/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-24T18:53:03.377740Z", "id": "CVE-2022-28736", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-24T18:53:12.420Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.openwall.com/lists/oss-security/2022/06/07/5", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28736", "tags": ["issue-tracking", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20230825-0002/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:03:52.084Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-28736", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-24T18:53:03.377740Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-24T18:53:08.037Z"}}], "cna": {"title": "There's a use-after-free vulnerability in grub_cmd_chainloader() function", "credits": [{"lang": "en", "type": "finder", "value": "Chris Coulson"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://git.savannah.gnu.org/cgit/grub.git", "vendor": "GNU Project", "product": "GNU GRUB", "versions": [{"status": "affected", "version": "0", "lessThan": "2.06-3", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "grub2"}], "datePublic": "2022-06-13T00:00:00.000Z", "references": [{"url": "https://www.openwall.com/lists/oss-security/2022/06/07/5", "tags": ["mailing-list"]}, {"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28736", "tags": ["issue-tracking"]}, {"url": "https://security.netapp.com/advisory/ntap-20230825-0002/"}], "descriptions": [{"lang": "en", "value": "There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved."}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2023-07-20T15:37:52.894Z"}}}, "cveMetadata": {"cveId": "CVE-2022-28736", "state": "PUBLISHED", "dateUpdated": "2024-10-24T18:53:12.420Z", "dateReserved": "2022-04-05T21:59:08.761Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2023-07-20T00:23:01.952Z", "assignerShortName": "canonical"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"packageName": "grub2", "platforms": ["Linux"], "product": "GNU GRUB", "repo": "https://git.savannah.gnu.org/cgit/grub.git", "vendor": "GNU Project", "versions": [{"lessThan": "2.06-3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*", "matchCriteriaId": "F969F462-AB12-4158-BBA9-A9D828434F9F", "versionEndExcluding": "2.06-3", "versionStartIncluding": "2.00", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved."}, {"lang": "es", "value": "Hay una vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n en la funci\u00f3n grub_cmd_chainloader(); El comando chainloader se utiliza para arrancar sistemas operativos que no soportan multiboot y no tienen soporte directo de GRUB2. Al ejecutar chainloader m\u00e1s de una vez, se activa una vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n. Si un atacante puede controlar el patr\u00f3n de asignaci\u00f3n de memoria de GRUB2, datos sensibles pueden quedar expuestos y se puede lograr la ejecuci\u00f3n de c\u00f3digo arbitrario."}], "id": "CVE-2022-28736", "lastModified": "2026-11-10T12:10:00.177", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 5.9, "source": "security@ubuntu.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-28736", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-10-24T18:53:03.377740Z", "version": "2.0.3"}}]}, "published": "2023-07-20T01:15:10.400", "references": [{"source": "security@ubuntu.com", "tags": ["Third Party Advisory"], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28736"}, {"source": "security@ubuntu.com", "url": "https://security.netapp.com/advisory/ntap-20230825-0002/"}, {"source": "security@ubuntu.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://www.openwall.com/lists/oss-security/2022/06/07/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28736"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20230825-0002/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://www.openwall.com/lists/oss-security/2022/06/07/5"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2022:5095", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "grub2-1:2.02-123.el8_6.8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-06-16T00:00:00Z"}, {"advisory": "RHSA-2022:5098", "cpe": "cpe:/o:redhat:rhel_e4s:8.1", "package": "grub2-1:2.02-87.el8_1.10", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-06-16T00:00:00Z"}, {"advisory": "RHSA-2022:5100", "cpe": "cpe:/o:redhat:rhel_eus:8.2", "package": "grub2-1:2.02-87.el8_2.10", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-06-16T00:00:00Z"}, {"advisory": "RHSA-2022:5096", "cpe": "cpe:/o:redhat:rhel_eus:8.4", "package": "grub2-1:2.02-99.el8_4.9", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-06-16T00:00:00Z"}, {"advisory": "RHSA-2022:5099", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "grub2-1:2.06-27.el9_0.7", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-06-16T00:00:00Z"}], "bugzilla": {"description": "grub2: use-after-free in grub_cmd_chainloader()", "id": "2092613", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2092613"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-416", "details": ["There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved.", "A use-after-free vulnerability was found on grub2's chainloader command. This flaw allows an attacker to gain access to restricted data or cause arbitrary code execution if they can establish control from grub's memory allocation pattern."], "name": "CVE-2022-28736", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "grub2", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2022-06-07T17:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-28736\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-28736"], "threat_severity": "Moderate"}

{}