| ID |
CVE-2022-28734
|
| Summary |
Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NULL byte past the buffer. It's conceivable that an attacker controlled set of packets can lead to corruption of the GRUB2's internal memory metadata. |
| References |
|
| Vulnerable Configurations |
-
cpe:2.3:a:gnu:grub2:2.00:*:*:*:*:*:*:*
cpe:2.3:a:gnu:grub2:2.00:*:*:*:*:*:*:*
-
cpe:2.3:a:gnu:grub2:2.01:*:*:*:*:*:*:*
cpe:2.3:a:gnu:grub2:2.01:*:*:*:*:*:*:*
-
cpe:2.3:a:gnu:grub2:2.02:*:*:*:*:*:*:*
cpe:2.3:a:gnu:grub2:2.02:*:*:*:*:*:*:*
-
cpe:2.3:a:gnu:grub2:2.04:*:*:*:*:*:*:*
cpe:2.3:a:gnu:grub2:2.04:*:*:*:*:*:*:*
-
cpe:2.3:a:gnu:grub2:2.06:*:*:*:*:*:*:*
cpe:2.3:a:gnu:grub2:2.06:*:*:*:*:*:*:*
-
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
|
| CVSS |
| Base: | None |
| Impact: | |
| Exploitability: | |
|
| CWE |
CWE-787 |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
|
|
|
|
| Impact |
| Confidentiality | Integrity | Availability |
|
|
|
|
| Last major update |
16-01-2024 - 19:43 |
| Published |
20-07-2023 - 01:15 |
| Last modified |
16-01-2024 - 19:43 |
