{"schemaVersion":3,"id":"USN-6355-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"grub2-signed, grub2-unsigned, shim, and shim-signed vulnerability\n\nDaniel Axtens discovered that specially crafted images could cause a\nheap-based out-of-bonds write. A local attacker could possibly use\nthis to circumvent secure boot protections. (CVE-2021-3695)\n\nDaniel Axtens discovered that specially crafted images could cause\nout-of-bonds read and write. A local attacker could possibly use this\nto circumvent secure boot protections. (CVE-2021-3696)\n\nDaniel Axtens discovered that specially crafted images could cause\nbuffer underwrite which allows arbitrary data to be written to a heap.\nA local attacker could possibly use this to circumvent secure\nboot protections. (CVE-2021-3697)\n\nIt was discovered that GRUB2 configuration files were created with\nthe wrong permissions. An attacker could possibly use this to leak\nencrypted passwords. (CVE-2021-3981)\n\nDaniel Axtens discovered that specially crafted IP packets could cause\nan integer underflow and write past the end of a buffer. An attacker\ncould possibly use this to circumvent secure boot protections.\n(CVE-2022-28733)\n\nDaniel Axtens discovered that specially crafted HTTP headers can cause\nan out-of-bounds write of a NULL byte. An attacker could possibly use\nthis to corrupt GRUB2's internal data. (CVE-2022-28734)\n\nJulian Andres Klode discovered that GRUB2 shim_lock allowed non-\nkernel files to be loaded. A local attack could possibly use this to\ncircumvent secure boot protections. (CVE-2022-28735)\n\nChris Coulson discovered that executing chainloaders more than once\ncaused a use-after-free vulnerability. A local attack could possibly\nuse this to circumvent secure boot protections. (CVE-2022-28736)\n\nChris Coulson discovered that specially crafted executables could\ncause shim to make out-of-bound writes. A local attack could possibly\nuse this to circumvent secure boot protections. (CVE-2022-28737)\n\nZhang Boyang discovered that specially crafted unicode sequences\ncould lead to an out-of-bounds write to a heap. A local attacker could\npossibly use this to circumvent secure boot protections.\n(CVE-2022-3775)","dates":{"published":"2023-09-08T21:56:31.000Z","modified":"2026-05-29T18:00:45.326Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"grub2-signed","name":"grub2-signed","label":"grub2-signed","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/grub2-signed","purlType":"deb","versions":[{"text":"< 1.187.3~20.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.187.3~22.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.187.3~20.04.1 | < 1.187.3~22.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"grub2-unsigned","name":"grub2-unsigned","label":"grub2-unsigned","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/grub2-unsigned","purlType":"deb","versions":[{"text":"< 2.06-2ubuntu14.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.06-2ubuntu14.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"shim","name":"shim","label":"shim","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/shim","purlType":"deb","versions":[{"text":"< 15.7-0ubuntu1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 15.7-0ubuntu1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"shim-signed","name":"shim-signed","label":"shim-signed","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/shim-signed","purlType":"deb","versions":[{"text":"< 1.40.9","noFixRecorded":false,"fixedIn":null},{"text":"< 1.51.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.40.9 | < 1.51.3","eol":null,"hubHref":null}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-6355-1","label":"ubuntu.com/security/notices/USN-6355-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3695","label":"ubuntu.com/security/CVE-2021-3695","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2021-3696","label":"ubuntu.com/security/CVE-2021-3696","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2021-3697","label":"ubuntu.com/security/CVE-2021-3697","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2021-3981","label":"ubuntu.com/security/CVE-2021-3981","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-3775","label":"ubuntu.com/security/CVE-2022-3775","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-28733","label":"ubuntu.com/security/CVE-2022-28733","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-28734","label":"ubuntu.com/security/CVE-2022-28734","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-28735","label":"ubuntu.com/security/CVE-2022-28735","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-28736","label":"ubuntu.com/security/CVE-2022-28736","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-28737","label":"ubuntu.com/security/CVE-2022-28737","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://launchpad.net/bugs/2029518","label":"launchpad.net/bugs/2029518","hostname":"launchpad.net","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2021-3695","CVE-2021-3696","CVE-2021-3697","CVE-2021-3981","CVE-2022-28733","CVE-2022-28734","CVE-2022-28735","CVE-2022-28736","CVE-2022-28737","CVE-2022-3775"],"downstream":[],"duplicates":[],"related":["CVE-2021-3695","CVE-2021-3696","CVE-2021-3697","CVE-2021-3981","CVE-2022-28733","CVE-2022-28734","CVE-2022-28735","CVE-2022-28736","CVE-2022-28737","CVE-2022-3775"]},"timeline":[{"kind":"published","date":"2023-09-08T21:56:31.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-05-29T18:00:45.326Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T13:26:34.699Z","stale":false,"partial":false}}