{"id":"CLSA-2024-1724266264","summary":"grub2: Fix of 12 CVEs","details":"- Fix package version number\n- Use CloudLinux vendor cert\n- Make this package installable only on a system having Cloudlinux signed\n  components: grub2 and kernel\n- Add patches from centos-8.5 ELS:\n- CVE-2021-3695: out-of-bounds write in the heap area by a crafted 16-bit\n  grayscale PNG image\n- CVE-2021-3696: a heap out-of-bounds during the handling of Huffman tables\n  in the PNG reader\n- CVE-2021-3697: allowing user-controlled data to be written in heap by a\n  crafted JPEG image\n- CVE-2022-2601: possible circumventing of the secure boot mechanism by a\n  malicious crafted pf2 font\n- CVE-2022-28733: possible write past the end of the buffer because of\n  integer underflow in grub_net_recv_ip4_packets()\n- CVE-2022-28734: out-of-bounds write when handling split HTTP headers\n- CVE-2022-28736: use-after-free vulnerability in grub_cmd_chainloader()\n- CVE-2022-3775: out-of-bounds write into grub2’s heap because of lack of\n  proper validation of glyph’s width and height\n- CVE-2023-4692: out-of-bounds write in grub2’s NTFS filesystem driver\n- The following CVEs were fixed by previous patches additionally:\n- CVE-2020-15706: a race condition in grub_script_function_create() leading\n  to a use-after-free vulnerability\n- CVE-2020-15707: integer overflows in efilinux leading to a heap-based\n  buffer overflow\n- A number of upstream fixes backported including:\n- CVE-2024-1048: a flaw that may result in filesystem running out of free\n  inodes or blocks","modified":"2026-05-27T11:33:48.756322121Z","published":"2024-08-21T19:58:03Z","upstream":["CVE-2020-15706","CVE-2020-15707","CVE-2021-3695","CVE-2021-3696","CVE-2021-3697","CVE-2022-2601","CVE-2022-28733","CVE-2022-28734","CVE-2022-28736","CVE-2022-3775","CVE-2023-4692","CVE-2024-1048"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/centos8stream-els/CLSA-2024-1724266264.html"}],"affected":[{"package":{"name":"grub2-common","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/grub2-common?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-129.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2024-1724266264.json"}},{"package":{"name":"grub2-efi-ia32","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/grub2-efi-ia32?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-129.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2024-1724266264.json"}},{"package":{"name":"grub2-efi-ia32-cdboot","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/grub2-efi-ia32-cdboot?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-129.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2024-1724266264.json"}},{"package":{"name":"grub2-efi-ia32-modules","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/grub2-efi-ia32-modules?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-129.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2024-1724266264.json"}},{"package":{"name":"grub2-efi-x64","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/grub2-efi-x64?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-129.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2024-1724266264.json"}},{"package":{"name":"grub2-efi-x64-cdboot","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/grub2-efi-x64-cdboot?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-129.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2024-1724266264.json"}},{"package":{"name":"grub2-efi-x64-modules","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/grub2-efi-x64-modules?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-129.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2024-1724266264.json"}},{"package":{"name":"grub2-pc","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/grub2-pc?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-129.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2024-1724266264.json"}},{"package":{"name":"grub2-pc-modules","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/grub2-pc-modules?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-129.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2024-1724266264.json"}},{"package":{"name":"grub2-tools","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/grub2-tools?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-129.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2024-1724266264.json"}},{"package":{"name":"grub2-tools-efi","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/grub2-tools-efi?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-129.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2024-1724266264.json"}},{"package":{"name":"grub2-tools-extra","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/grub2-tools-extra?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-129.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2024-1724266264.json"}},{"package":{"name":"grub2-tools-minimal","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/grub2-tools-minimal?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-129.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2024-1724266264.json"}}],"schema_version":"1.7.5"}