high 8.6

CVE-2022-2601 json

A buffer overflow was found in grub_font_construct_glyph().

published 2022-12-14 3y ago modified 2026-06-17 4mo ago also EUVD-2022-34848

cvss: 8.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits: 0; none known

A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.

Patch / fix

distros 8

debian ubuntu red hat suse opensuse almalinux rocky linux azure linux

grub2 Debian 14, Debian 13, Debian 12 2.06-5

debian advisories DEBIAN-CVE-2022-2601

grub2-signed Ubuntu 18.04 LTS 1.187.3~18.04.1
grub2-signed Ubuntu 20.04 LTS 1.187.3~20.04.1
grub2-signed Ubuntu 22.04 LTS 1.187.3~22.04.1
grub2-unsigned Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS 2.06-2ubuntu14.1

ubuntu advisories UBUNTU-CVE-2022-2601

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

grub2 RHEL 7 1:2.02-0.87.el7_9.14
grub2-pc RHEL 7 1:2.02-0.87.el7_9.14
grub2-ppc64 RHEL 7 1:2.02-0.87.el7_9.14
grub2-tools RHEL 7 1:2.02-0.87.el7_9.14
grub2-common RHEL 7 1:2.02-0.87.el7_9.14
grub2-efi-x64 RHEL 7 1:2.02-0.87.el7_9.14
grub2-ppc64le RHEL 7 1:2.02-0.87.el7_9.14
grub2-efi-ia32 RHEL 7 1:2.02-0.87.el7_9.14

red hat advisories RHSA-2024:2002 RHSA-2023:0752 RHSA-2023:0049 RHSA-2023:0047 RHSA-2023:0048 RHSA-2022:8978

grub2 SLE Micro 5.1 2.04-150300.3.8.1
grub2 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 2.02-153.1
grub2 SLE Module for Server Applications 15 SP3, SLE Module for Basesystem 15 SP3, SLE Micro 5.2 +3 more 2.04-150300.22.25.1
grub2 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +6 more 2.04-150200.9.68.1
grub2 SLES 12 SP2-BCL 2.02-115.72.1
grub2 SLES 12 SP3-BCL 2.02-142.1
grub2 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +3 more 2.02-150100.123.17.1
grub2 SLE Module for Server Applications 15 SP4, SLE Module for Basesystem 15 SP4, SLE Micro 5.3 +3 more 2.06-150400.11.17.1

suse advisories SUSE-SU-2023:1701-1 SUSE-SU-2022:4302-1 SUSE-SU-2022:4219-1 SUSE-SU-2022:4218-1 SUSE-SU-2022:4144-1 SUSE-SU-2022:4143-1

grub2 openSUSE Tumbleweed 2.06-31.1

opensuse advisories openSUSE-SU-2024:12517-1

grub2-pc AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-tools AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-common AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-efi-x64 AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-ppc64le AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-efi-aa64 AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-tools-efi AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-pc-modules AlmaLinux 9 1:2.06-46.el9_1.3.alma

almalinux advisories ALSA-2023:0752 ALSA-2023:0049

grub2 Rocky Linux 9 1:2.06-46.el9_1.3.rocky.0.2
grub2 Rocky Linux 8 1:2.02-142.el8_7.1.rocky.0.2

rocky linux advisories RLSA-2023:0752 RLSA-2023:0049

grub2 CBL-Mariner 2.0 2.06-8
grub2 Azure Linux 3.0 2.06-14

azure linux advisories AZL-11604 AZL-34787

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2022-2601 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-2601 updated 2026-05-27 cvss 8.2

grub2: Buffer overflow in grub_font_construct_glyph() can lead to out-of-bound write and possible secure boot bypass

Red Hat Enterprise Linux BaseOS (v. 8) grub2 2.02-142.el8_7.1, grub2-pc 2.02-142.el8_7.1, grub2-tools 2.02-142.el8_7.1, grub2-common 2.02-142.el8_7.1, grub2-efi-x64 2.02-142.el8_7.1, grub2-ppc64le 2.02-142.el8_7.1, +13 more
fixed: vendor fix RHSA-2023:0049
Red Hat Enterprise Linux BaseOS (v. 9) grub2 2.06-46.el9_1.3, grub2-pc 2.06-46.el9_1.3, grub2-tools 2.06-46.el9_1.3, grub2-common 2.06-46.el9_1.3, grub2-efi-x64 2.06-46.el9_1.3, grub2-ppc64le 2.06-46.el9_1.3, +10 more
fixed: vendor fix RHSA-2023:0752
Red Hat Enterprise Linux BaseOS AUS (v. 8.2) grub2 2.02-87.el8_2.11, grub2-pc 2.02-87.el8_2.11, grub2-tools 2.02-87.el8_2.11, grub2-common 2.02-87.el8_2.11, grub2-efi-x64 2.02-87.el8_2.11, grub2-efi-ia32 2.02-87.el8_2.11, +10 more
fixed: vendor fix RHSA-2022:8800
Red Hat Enterprise Linux BaseOS E4S (v. 8.1) grub2 2.02-87.el8_1.11, grub2-pc 2.02-87.el8_1.11, grub2-tools 2.02-87.el8_1.11, grub2-common 2.02-87.el8_1.11, grub2-efi-x64 2.02-87.el8_1.11, grub2-ppc64le 2.02-87.el8_1.11, +11 more
fixed: vendor fix RHSA-2022:8494
Red Hat Enterprise Linux BaseOS E4S (v. 8.2) grub2 2.02-87.el8_2.11, grub2-pc 2.02-87.el8_2.11, grub2-tools 2.02-87.el8_2.11, grub2-common 2.02-87.el8_2.11, grub2-efi-x64 2.02-87.el8_2.11, grub2-ppc64le 2.02-87.el8_2.11, +11 more
fixed: vendor fix RHSA-2022:8800
Red Hat Enterprise Linux BaseOS EUS (v.8.4) grub2 2.02-99.el8_4.10, grub2-pc 2.02-99.el8_4.10, grub2-tools 2.02-99.el8_4.10, grub2-common 2.02-99.el8_4.10, grub2-efi-x64 2.02-99.el8_4.10, grub2-ppc64le 2.02-99.el8_4.10, +13 more
fixed: vendor fix RHSA-2023:0047
Red Hat Enterprise Linux BaseOS EUS (v.8.6) grub2 2.02-123.el8_6.12, grub2-pc 2.02-123.el8_6.12, grub2-tools 2.02-123.el8_6.12, grub2-common 2.02-123.el8_6.12, grub2-efi-x64 2.02-123.el8_6.12, grub2-ppc64le 2.02-123.el8_6.12, +13 more
fixed: vendor fix RHSA-2023:0048
Red Hat Enterprise Linux BaseOS EUS (v.9.0) grub2 2.06-27.el9_0.12, grub2-pc 2.06-27.el9_0.12, grub2-tools 2.06-27.el9_0.12, grub2-common 2.06-27.el9_0.12, grub2-efi-x64 2.06-27.el9_0.12, grub2-ppc64le 2.06-27.el9_0.12, +10 more
fixed: vendor fix RHSA-2022:8978

show 2 more

Red Hat Enterprise Linux BaseOS TUS (v. 8.2) grub2 2.02-87.el8_2.11, grub2-pc 2.02-87.el8_2.11, grub2-tools 2.02-87.el8_2.11, grub2-common 2.02-87.el8_2.11, grub2-efi-x64 2.02-87.el8_2.11, grub2-efi-ia32 2.02-87.el8_2.11, +10 more
fixed: vendor fix RHSA-2022:8800
Red Hat Enterprise Linux Client (v. 7) grub2 2.02-0.87.el7_9.14, grub2-pc 2.02-0.87.el7_9.14, grub2-ppc64 2.02-0.87.el7_9.14, grub2-tools 2.02-0.87.el7_9.14, grub2-common 2.02-0.87.el7_9.14, grub2-efi-x64 2.02-0.87.el7_9.14, +13 more Red Hat Enterprise Linux Client Optional (v. 7) grub2 2.02-0.87.el7_9.14, grub2-pc 2.02-0.87.el7_9.14, grub2-ppc64 2.02-0.87.el7_9.14, grub2-tools 2.02-0.87.el7_9.14, grub2-common 2.02-0.87.el7_9.14, grub2-efi-x64 2.02-0.87.el7_9.14, +13 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) grub2 2.02-0.87.el7_9.14, grub2-pc 2.02-0.87.el7_9.14, grub2-ppc64 2.02-0.87.el7_9.14, grub2-tools 2.02-0.87.el7_9.14, grub2-common 2.02-0.87.el7_9.14, grub2-efi-x64 2.02-0.87.el7_9.14, +13 more Red Hat Enterprise Linux Server (v. 7) grub2 2.02-0.87.el7_9.14, grub2-pc 2.02-0.87.el7_9.14, grub2-ppc64 2.02-0.87.el7_9.14, grub2-tools 2.02-0.87.el7_9.14, grub2-common 2.02-0.87.el7_9.14, grub2-efi-x64 2.02-0.87.el7_9.14, +13 more Red Hat Enterprise Linux Server Optional (v. 7) grub2 2.02-0.87.el7_9.14, grub2-pc 2.02-0.87.el7_9.14, grub2-ppc64 2.02-0.87.el7_9.14, grub2-tools 2.02-0.87.el7_9.14, grub2-common 2.02-0.87.el7_9.14, grub2-efi-x64 2.02-0.87.el7_9.14, +13 more Red Hat Enterprise Linux Workstation (v. 7) grub2 2.02-0.87.el7_9.14, grub2-pc 2.02-0.87.el7_9.14, grub2-ppc64 2.02-0.87.el7_9.14, grub2-tools 2.02-0.87.el7_9.14, grub2-common 2.02-0.87.el7_9.14, grub2-efi-x64 2.02-0.87.el7_9.14, +13 more

+1 more productsfewer

Red Hat Enterprise Linux Workstation Optional (v. 7) grub2 2.02-0.87.el7_9.14, grub2-pc 2.02-0.87.el7_9.14, grub2-ppc64 2.02-0.87.el7_9.14, grub2-tools 2.02-0.87.el7_9.14, grub2-common 2.02-0.87.el7_9.14, grub2-efi-x64 2.02-0.87.el7_9.14, +13 more

fixed: vendor fix RHSA-2024:2002

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: last yr. (2025-05-20)

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD	3.1	8.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA	3.1	8.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

n/a grub2

Classification

Weakness

CWE-122 Heap-based Buffer Overflow
CWE-787 Out-of-bounds Write

References

security.gentoo.org /glsa/202311-14
vendor-advisory
bugzilla.redhat.com /show_bug.cgi?id=2112975#c0
issue-tracking, third-party-advisory
security.netapp.com /advisory/ntap-20230203-0004/
arstechnica.com /security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-linux-users/

Sources

CVE List CVE-2022-2601
NVD CVE-2022-2601

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed