CVE-2022-3675 - Fedora CoreOS supports setting a GRUB bootloader password

Back Back to CVE browser

MEDIUM

Fedora CoreOS supports setting a GRUB bootloader password

Published Nov 3, 2022

5.5

MEDIUM

CVSS 3.1

EPSS 0.18%

Description

Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB command-line, modify kernel command-line arguments, or boot non-default OSTree deployments. Recent Fedora CoreOS releases have a misconfiguration which allows booting non-default OSTree deployments without entering a password. This allows someone with access to the GRUB menu to boot into an older version of Fedora CoreOS, reverting any security fixes that have recently been applied to the machine. A password is still required to modify kernel command-line arguments and to access the GRUB command line.

Affected products

Vendor Fedora Project Product CoreOS Default
unaffected
- Version
  next 36.20220906.1.0 and later
  Status
  affected
  Constraints
  <next 37.20221031.1.0
- Version
  stable 36.20220820.3.0 and later
  Status
  affected
  Constraints
  <stable 36.20221014.3.0
- Version
  testing 36.20220906.2.0 and later
  Status
  affected
  Constraints
  <testing 36.20221030.2.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fedora Project

CoreOS

unaffected

Version	Status	Constraints
next 36.20220906.1.0 and later	affected	<next 37.20221031.1.0
stable 36.20220820.3.0 and later	affected	<stable 36.20221014.3.0
testing 36.20220906.2.0 and later	affected	<testing 36.20221030.2.0

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-306

Missing Authentication

References (4)

https://docs.fedoraproject.org/en-US/fedora-coreos/grub-password/
relatedVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43034
Advisory
https://github.com/coreos/fedora-coreos-tracker/issues/1333
issue-trackingIssue TrackingThird Party Advisory
https://lists.fedoraproject.org/archives/list/coreos-status@lists.fedoraproject.org/thread/NHUCNH5Y4UH5DPUCXISYXXVA563TLFEJ/
release-notesMailing ListVendor Advisory

Link	Providers	Tags
https://docs.fedoraproject.org/en-US/fedora-coreos/grub-password/		relatedVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43034		Advisory
https://github.com/coreos/fedora-coreos-tracker/issues/1333		issue-trackingIssue TrackingThird Party Advisory
https://lists.fedoraproject.org/archives/list/coreos-status@lists.fedoraproject.org/thread/NHUCNH5Y4UH5DPUCXISYXXVA563TLFEJ/		release-notesMailing ListVendor Advisory