CVE-2022-28735

MEDIUM

GRUB2 >= 2.00 < 2.06-3 - Unverified Code Execution via Shim Lock Verifier Bypass

Title source: llm

Description

The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules to be loaded in GRUB2 breaking the secure boot trust-chain.

References (3)

Core 3

Core References

Mailing List, Third Party Advisory mailing-list

https://www.openwall.com/lists/oss-security/2022/06/07/5

Third Party Advisory issue-tracking

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28735

Vendor Advisory

https://security.netapp.com/advisory/ntap-20230825-0002/

Scores

CVSS v3 6.7

EPSS 0.0002

EPSS Percentile 5.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

Status published

Products (1)

gnu/grub2 2.00 - 2.06-3

Published Jul 20, 2023

Tracked Since Feb 18, 2026