CVE-2022-1665

HighCVSS 8.2/10Last modified Oct 8, 2026

Description

A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing the attacker to load another non-trusted code.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1291

Affected software

No affected versions have been published.

Timeline

Published: Jun 21, 2022
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-16666.5The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 hash was used to crack the pass CVE-2022-16677.5Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by l CVE-2022-16689.8Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.CVE-2022-16698.1A buffer overflow vulnerability has been detected in the firewall function of the device management web portal. The device runs a CGI binary CVE-2022-16707.5When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possib CVE-2022-16717.1A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux kernel. This flaw allows a local attack CVE-2022-16728.8The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Cust CVE-2022-16736.1The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it t CVE-2022-16745.5NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Derefe CVE-2022-16776.3In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into CVE-2022-16787.5An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns l CVE-2022-16797.8A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target