CVE-2022-2601HighMicrosoft CVSS 8.6CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Microsoft security update for CVE-2022-2601

Published
August 13, 2024
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2022-2601 →

📋 Microsoft's advisory

EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-2601. This page also shows what EchelonGraph holds for CVE-2022-2601, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.

🎯 Affected products37

  • Azure Linux 3.0 ARM
  • Azure Linux 3.0 x64
  • CBL Mariner 1.0 ARM
  • CBL Mariner 1.0 x64
  • CBL Mariner 2.0 ARM
  • CBL Mariner 2.0 x64
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 11 Version 22H2 for ARM64-based Systems
  • Windows 11 Version 22H2 for x64-based Systems
  • Windows 11 Version 23H2 for ARM64-based Systems
  • Windows 11 Version 23H2 for x64-based Systems
  • Windows 11 Version 24H2 for ARM64-based Systems
  • Windows 11 Version 24H2 for x64-based Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 11 version 21H2 for x64-based Systems
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)
  • +7 more not shown

✅ Updates Microsoft lists: 11 KB articles and 3 other updates

16 rows: one per KB article or update, update type and fixed build. Their details are on Microsoft's advisory.

KB articleUpdateFixed build
—CBL-Mariner2.06-14
—CBL-Mariner2.06~rc1-9
—CBL-Mariner2.06-8
KB5055519Security Update10.0.17763.7136
KB5055526Security Update10.0.20348.3453
KB5041592Security Update10.0.22000.3147
KB5055518Security Update10.0.19044.5737
KB5055528Security Update10.0.22621.5189
KB5055518Security Update10.0.19045.5737
KB5055528Security Update10.0.22631.5189
KB5055527Security Update10.0.25398.1551
KB5055547Security Update10.0.10240.20978
KB5055521Security Update10.0.14393.7969
KB5055581Monthly Rollup6.2.9200.25423
KB5055557Monthly Rollup6.3.9600.22523
KB5055523Security Update10.0.26100.3775

🧭 EchelonGraph on CVE-2022-2601

EchelonGraph score
8.6 HIGH
CISA KEV
Not listed
Fix status
A fix is available — apply it.

Description from the CVE record (CVE.org), as published by its numbering authority

A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.

Published by Red Hat, Inc., the CVE Numbering Authority that assigned CVE-2022-2601, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).

🔗 References (24)