The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5096 advisory.

  - grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)

  - grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)

  - grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)

  - grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)

  - grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)

  - grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)

  - grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)

  - shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 8 : grub2, mokutil, shim, and shim-unsigned-x64 (RHSA-2022:5096)

high Nessus Plugin ID 162326

Version 1.8