CVE-2022-1665CWE-1291

CVE-2022-1665

High · published June 21, 2022

CVSS v3.1
8.2
EPSS
0%
Percentile
18.5
In the wild
Unconfirmed
What it is

A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing the attacker to load another non-trusted code.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00272 · 18.5th percentile
Weakness
CWE-1291 · Public Key Re-Use for Signing both Debug and Production Code
Published
2022-06-21T19:15Z
Affected products (1)
ProductVersionsFixed in
redhat/enterprise_linuxall versions—
References (2)
https://bugzilla.redhat.com/show_bug.cgi?id=2089529 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2089529 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 21 JUN 14:23Z
    A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it…
    cvelistv5