Vulnerability Details : CVE-2022-3675
Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB command-line, modify kernel command-line arguments, or boot non-default OSTree deployments. Recent Fedora CoreOS releases have a misconfiguration which allows booting non-default OSTree deployments without entering a password. This allows someone with access to the GRUB menu to boot into an older version of Fedora CoreOS, reverting any security fixes that have recently been applied to the machine. A password is still required to modify kernel command-line arguments and to access the GRUB command line.
Vulnerability category: Input validation
Products affected by CVE-2022-3675
- cpe:2.3:a:redhat:fedora_coreos:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-3675
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 17 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-3675
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
1.8
|
3.6
|
NIST | |
|
2.6
|
LOW | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
0.9
|
1.4
|
Fedora Project |
CWE ids for CVE-2022-3675
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: patrick@puiterwijk.org (Secondary)
-
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.Assigned by: nvd@nist.gov (Primary)
-
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-3675
-
https://github.com/coreos/fedora-coreos-tracker/issues/1333
Non-default OSTree deployments accessible without GRUB password (CVE-2022-3675) · Issue #1333 · coreos/fedora-coreos-tracker · GitHubIssue Tracking;Third Party Advisory
-
https://docs.fedoraproject.org/en-US/fedora-coreos/grub-password/
Setting a GRUB password :: Fedora DocsVendor Advisory
-
https://lists.fedoraproject.org/archives/list/coreos-status@lists.fedoraproject.org/thread/NHUCNH5Y4UH5DPUCXISYXXVA563TLFEJ/
Non-default OSTree deployments accessible without GRUB password (CVE-2022-3675) - coreos-status - Fedora Mailing-ListsMailing List;Vendor Advisory
Jump to