CVE-2022-28734: gnu project gnu grub Out-of-bounds Write

Vulnerability summary

CVE-2022-28734 is a high (CVSS 8.1) Out-of-bounds Write vulnerability in gnu project gnu grub. EPSS estimates a 1.12% chance of exploitation in the next 30 days, higher than 65.6% of scored vulnerabilities.

Timeline

1. 20-07-2023
   PublishedVulnerability first disclosed.
2. 13-02-2025
   Last modifiedVulnerability information updated.

Description

Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NULL byte past the buffer. It's conceivable that an attacker controlled set of packets can lead to corruption of the GRUB2's internal memory metadata.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.