CVE-2022-3675

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB command-line, modify kernel command-line arguments, or boot non-default OSTree deployments. Recent Fedora CoreOS releases have a misconfiguration which allows booting non-default OSTree deployments without entering a password. This allows someone with access to the GRUB menu to boot into an older version of Fedora CoreOS, reverting any security fixes that have recently been applied to the machine. A password is still required to modify kernel command-line arguments and to access the GRUB command line.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20 CWE-306

Affected software

Vendor	Product	Versions
Fedora Project	CoreOS	>= testing 36.20220906.2.0 and later, < testing 36.20221030.2.0 ; >= next 36.20220906.1.0 and later, < next 37.20221031.1.0; >= stable 36.20220820.3.0 and later, < stable 36.20221014.3.0

References

https://docs.fedoraproject.org/en-US/fedora-coreos/grub-password/Vendor Advisory
https://github.com/coreos/fedora-coreos-tracker/issues/1333Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/coreos-status@lists.fedoraproject.org/thread/NHUCNH5Y4UH5DPUCXISYXXVA563TLFEJ/Mailing List, Vendor Advisory
https://docs.fedoraproject.org/en-US/fedora-coreos/grub-password/Vendor Advisory
https://github.com/coreos/fedora-coreos-tracker/issues/1333Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/coreos-status@lists.fedoraproject.org/thread/NHUCNH5Y4UH5DPUCXISYXXVA563TLFEJ/Mailing List, Vendor Advisory

Timeline

Published: Nov 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-367509.8Clinic's Patient Management System v1.0 is vulnerable to SQL injection via /pms/update_user.php?id=.CVE-2022-367525.5png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. This vulnerability is exploitable via a crafted png f CVE-2022-367547.2Expense Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Home/debit_credit_p.CVE-2022-367559.8D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg.php.CVE-2022-367569.8DIR845L A1 v1.00-v1.03 is vulnerable to command injection via /htdocs/upnpinc/gena.php.CVE-2022-367599.8Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /dishes.php?res_id=.CVE-2022-36766.5In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of t CVE-2022-367609.0Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attac CVE-2022-367637.8EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local CVE-2022-367647.8EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local n CVE-2022-367657.8EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a l CVE-2022-367687.8IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to obtain roo