CVE-2022-3675: fedora project coreos Improper Input Validation
Vulnerability summary
CVE-2022-3675 is a medium (CVSS 5.5) Improper Input Validation vulnerability in fedora project coreos. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.9% of scored vulnerabilities.
Timeline
- 03-11-2022PublishedVulnerability first disclosed.
- 02-05-2025Last modifiedVulnerability information updated.
Description
Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB command-line, modify kernel command-line arguments, or boot non-default OSTree deployments. Recent Fedora CoreOS releases have a misconfiguration which allows booting non-default OSTree deployments without entering a password. This allows someone with access to the GRUB menu to boot into an older version of Fedora CoreOS, reverting any security fixes that have recently been applied to the machine. A password is still required to modify kernel command-line arguments and to access the GRUB command line.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA2.6LowCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
0.00 pp
From 0.18% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Fedora project1 product
- coreos≥ testing 36.20220906.2.0 and later, < testing 36.20221030.2.0 | ≥ next 36.20220906.1.0 and later, < next 37.20221031.1.0 | ≥ stable 36.20220820.3.0 and later, < stable 36.20221014.3.0
Redhat1 product
- fedora_coreos≥ 36.20220820.3.0, < 37.20221031.1.0
2 vendors · 2 products