CVE-2022-28735

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules to be loaded in GRUB2 breaking the secure boot trust-chain.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
GNU Project	GNU GRUB	< 2.06-3

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28735Third Party Advisory
https://security.netapp.com/advisory/ntap-20230825-0002/
https://www.openwall.com/lists/oss-security/2022/06/07/5Mailing List, Third Party Advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28735Third Party Advisory
https://security.netapp.com/advisory/ntap-20230825-0002/
https://www.openwall.com/lists/oss-security/2022/06/07/5Mailing List, Third Party Advisory

Timeline

Published: Jul 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-287367.8There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that CVE-2022-287377.8There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes CVE-2022-287389.8A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from CVE-2022-287397.5There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Floa CVE-2022-28745.5NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.CVE-2022-287407.5aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor.CVE-2022-287418.1aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability that occurs due to mis CVE-2022-287427.5aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user CVE-2022-287436.6Time-of-check Time-of-use (TOCTOU) Race Condition vulerability in Foscam R2C IP camera running System FW <= 1.13.1.6, and Application FW <= CVE-2022-287479.8Key reuse in GoSecure Titan Inbox Detection & Response (IDR) through 2022-04-05 leads to remote code execution. To exploit this vulnerabilit CVE-2022-287494.3Zooms On-Premise Meeting Connector MMR before version 4.8.113.20220526 fails to properly check the permissions of a Zoom meeting attendee. A CVE-2022-287509.8Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can r