CVE catalog

CVE-2022-28735

grub2: CVE-2022-28735

[CVE catalog]

Severity
High · CVSS 8.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.31% · Oct 25, 2026

The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules to be loaded in GRUB2 breaking the secure boot trust-chain.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangrub2sid2.14-4fixed
Debiangrub2forky2.14-4fixed
Debiangrub2trixie2.12-9+deb13u2fixed
Debiangrub2bookworm2.06-13+deb12u2fixed
Debiangrub2bookworm-security2.06-13+deb12u1fixed
Ubuntugrub2-signedpro1.22vulnerable
Ubuntugrub2-signedpro1.23vulnerable
Ubuntugrub2-signedpro1.24vulnerable
Ubuntugrub2-signedpro1.25vulnerable
Ubuntugrub2-signedpro1.26vulnerable
Ubuntugrub2-signedpro1.27vulnerable
Ubuntugrub2-signedpro1.30vulnerable
Ubuntugrub2-signedpro1.31vulnerable
Ubuntugrub2-signedpro1.32vulnerable
Ubuntugrub2-signedpro1.33vulnerable
Ubuntugrub2-signedpro1.34vulnerable
Ubuntugrub2-signedpro1.34.1vulnerable
Ubuntugrub2-signedpro1.34.2vulnerable
Ubuntugrub2-signedpro1.34.3vulnerable
Ubuntugrub2-signedpro1.34.4vulnerable
Ubuntugrub2-signedpro1.34.5vulnerable
Ubuntugrub2-signedpro1.34.6vulnerable
Ubuntugrub2-signedpro1.34.7vulnerable
Ubuntugrub2-signedpro1.34.8vulnerable
Ubuntugrub2-signedpro1.34.9vulnerable
Ubuntugrub2-signedpro1.34.13vulnerable
Ubuntugrub2-signedpro1.34.14vulnerable
Ubuntugrub2-signedpro1.34.16vulnerable
Ubuntugrub2-signedpro1.34.17vulnerable
Ubuntugrub2-signedpro1.34.18vulnerable
Ubuntugrub2-signedpro1.34.20vulnerable
Ubuntugrub2-signedpro1.34.22vulnerable
Ubuntugrub2-signedpro1.34.24vulnerable
Ubuntugrub2-signed16.041.55vulnerable
Ubuntugrub2-signed16.041.56vulnerable
Ubuntugrub2-signed16.041.57vulnerable
Ubuntugrub2-signed16.041.58vulnerable
Ubuntugrub2-signed16.041.59vulnerable
Ubuntugrub2-signed16.041.61vulnerable
Ubuntugrub2-signed16.041.62vulnerable
Ubuntugrub2-signed16.041.63vulnerable
Ubuntugrub2-signed16.041.64vulnerable
Ubuntugrub2-signed16.041.65vulnerable
Ubuntugrub2-signed16.041.66vulnerable
Ubuntugrub2-signed16.041.66.1vulnerable
Ubuntugrub2-signed16.041.66.2vulnerable
Ubuntugrub2-signed16.041.66.6vulnerable
Ubuntugrub2-signed16.041.66.7vulnerable
Ubuntugrub2-signed16.041.66.8vulnerable
Ubuntugrub2-signed16.041.66.9vulnerable
Ubuntugrub2-signed16.041.66.11vulnerable
Ubuntugrub2-signed16.041.66.12vulnerable
Ubuntugrub2-signed16.041.66.14vulnerable
Ubuntugrub2-signed16.041.66.15vulnerable
Ubuntugrub2-signed16.041.66.16vulnerable
Ubuntugrub2-signed16.041.66.17vulnerable
Ubuntugrub2-signed16.041.66.18vulnerable
Ubuntugrub2-signed16.041.66.19vulnerable
Ubuntugrub2-signed16.041.66.20vulnerable
Ubuntugrub2-signed16.041.66.21vulnerable
Ubuntugrub2-signed16.041.66.22vulnerable
Ubuntugrub2-signed16.041.66.23vulnerable
Ubuntugrub2-signed16.041.66.26vulnerable
Ubuntugrub2-signed16.041.66.27vulnerable
Ubuntugrub2-signed16.041.66.28vulnerable
Ubuntugrub2-signed16.041.66.29vulnerable
Ubuntugrub2-signed16.041.167~16.04.1vulnerable
Ubuntugrub2-signed16.041.167~16.04.2vulnerable
Ubuntugrub2-signed16.041.167~16.04.4vulnerable
Ubuntugrub2-signed16.041.167~16.04.6vulnerable
Ubuntugrub2-unsigned16.042.04-1ubuntu44vulnerable
Ubuntugrub2-unsigned16.042.04-1ubuntu44.1vulnerable
Ubuntugrub2-unsigned16.042.04-1ubuntu44.1.2vulnerable
Ubuntugrub2-signed18.041.85vulnerable
Ubuntugrub2-signed18.041.86vulnerable
Ubuntugrub2-signed18.041.87vulnerable
Ubuntugrub2-signed18.041.89vulnerable
Ubuntugrub2-signed18.041.91vulnerable
Ubuntugrub2-signed18.041.92vulnerable
Ubuntugrub2-signed18.041.93vulnerable
Ubuntugrub2-signed18.041.93.1vulnerable
Ubuntugrub2-signed18.041.93.2vulnerable
Ubuntugrub2-signed18.041.93.3vulnerable
Ubuntugrub2-signed18.041.93.4vulnerable
Ubuntugrub2-signed18.041.93.5vulnerable
Ubuntugrub2-signed18.041.93.7vulnerable
Ubuntugrub2-signed18.041.93.8vulnerable
Ubuntugrub2-signed18.041.93.10vulnerable
Ubuntugrub2-signed18.041.93.11vulnerable
Ubuntugrub2-signed18.041.93.13vulnerable
Ubuntugrub2-signed18.041.93.14vulnerable
Ubuntugrub2-signed18.041.93.15vulnerable
Ubuntugrub2-signed18.041.93.16vulnerable
Ubuntugrub2-signed18.041.93.18vulnerable
Ubuntugrub2-signed18.041.93.19vulnerable
Ubuntugrub2-signed18.041.93.20vulnerable
Ubuntugrub2-signed18.041.93.21vulnerable
Ubuntugrub2-signed18.041.93.22vulnerable
Ubuntugrub2-signed18.041.93.24vulnerable
Ubuntugrub2-signed18.041.167~18.04.1vulnerable
Ubuntugrub2-signed18.041.167~18.04.3vulnerable
Ubuntugrub2-signed18.041.167~18.04.5vulnerable
Ubuntugrub2-signed18.041.173.2~18.04.1vulnerable
Ubuntugrub2-signed18.041.187.2~18.04.1vulnerable
Ubuntugrub2-signed18.041.187.3~18.04.1fixed
Ubuntugrub2-unsigned18.042.04-1ubuntu44vulnerable
Ubuntugrub2-unsigned18.042.04-1ubuntu44.1vulnerable
Ubuntugrub2-unsigned18.042.04-1ubuntu44.1.2vulnerable
Ubuntugrub2-unsigned18.042.04-1ubuntu47.4vulnerable
Ubuntugrub2-unsigned18.042.06-2ubuntu14vulnerable
Ubuntugrub2-unsigned18.042.06-2ubuntu14.1fixed
Ubuntugrub2-signed20.041.128vulnerable
Ubuntugrub2-signed20.041.129vulnerable
Ubuntugrub2-signed20.041.130vulnerable
Ubuntugrub2-signed20.041.131vulnerable
Ubuntugrub2-signed20.041.133vulnerable
Ubuntugrub2-signed20.041.134vulnerable
Ubuntugrub2-signed20.041.135vulnerable
Ubuntugrub2-signed20.041.136vulnerable
Ubuntugrub2-signed20.041.137vulnerable
Ubuntugrub2-signed20.041.138vulnerable
Ubuntugrub2-signed20.041.139vulnerable
Ubuntugrub2-signed20.041.140vulnerable
Ubuntugrub2-signed20.041.141vulnerable
Ubuntugrub2-signed20.041.142vulnerable
Ubuntugrub2-signed20.041.142.1vulnerable
Ubuntugrub2-signed20.041.142.3vulnerable
Ubuntugrub2-signed20.041.142.4vulnerable
Ubuntugrub2-signed20.041.142.5vulnerable
Ubuntugrub2-signed20.041.142.6vulnerable
Ubuntugrub2-signed20.041.142.8vulnerable
Ubuntugrub2-signed20.041.142.9vulnerable
Ubuntugrub2-signed20.041.142.10vulnerable
Ubuntugrub2-signed20.041.142.11vulnerable
Ubuntugrub2-signed20.041.167vulnerable
Ubuntugrub2-signed20.041.167.2vulnerable
Ubuntugrub2-signed20.041.173.2~20.04.1vulnerable
Ubuntugrub2-signed20.041.173.4vulnerable
Ubuntugrub2-signed20.041.187.2~20.04.2vulnerable
Ubuntugrub2-signed20.041.187.3~20.04.1fixed
Ubuntugrub2-unsigned20.042.04-1ubuntu44vulnerable
Ubuntugrub2-unsigned20.042.04-1ubuntu44.2vulnerable
Ubuntugrub2-unsigned20.042.04-1ubuntu47.4vulnerable
Ubuntugrub2-unsigned20.042.04-1ubuntu47.5vulnerable
Ubuntugrub2-unsigned20.042.06-2ubuntu14vulnerable
Ubuntugrub2-unsigned20.042.06-2ubuntu14.1fixed
Ubuntugrub2-signed22.041.173vulnerable
Ubuntugrub2-signed22.041.174vulnerable
Ubuntugrub2-signed22.041.176vulnerable
Ubuntugrub2-signed22.041.177vulnerable
Ubuntugrub2-signed22.041.178vulnerable
Ubuntugrub2-signed22.041.179vulnerable
Ubuntugrub2-signed22.041.180vulnerable
Ubuntugrub2-signed22.041.182~22.04.1vulnerable
Ubuntugrub2-signed22.041.187.2vulnerable
Ubuntugrub2-signed22.041.187.3~22.04.1fixed
Ubuntugrub2-unsigned22.042.04-1ubuntu47vulnerable
Ubuntugrub2-unsigned22.042.04-1ubuntu48vulnerable
Ubuntugrub2-unsigned22.042.06-2ubuntu3vulnerable
Ubuntugrub2-unsigned22.042.06-2ubuntu4vulnerable
Ubuntugrub2-unsigned22.042.06-2ubuntu5vulnerable
Ubuntugrub2-unsigned22.042.06-2ubuntu6vulnerable
Ubuntugrub2-unsigned22.042.06-2ubuntu7vulnerable
Ubuntugrub2-unsigned22.042.06-2ubuntu10vulnerable
Ubuntugrub2-unsigned22.042.06-2ubuntu14vulnerable
Ubuntugrub2-unsigned22.042.06-2ubuntu14.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangrub2sourcesid2.06-3not yet assignedNot reported[1001057]
Debiangrub2sourceforky2.06-3not yet assignedNot reported[1001057]
Debiangrub2sourcetrixie2.06-3not yet assignedNot reported[1001057]
Debiangrub2sourcebookworm2.06-3not yet assignedNot reported[1001057]
Ubuntugrub2-signeddeb18.041.187.3~18.04.1Not reportedUBUNTU-CVE-2022-28735Not reported
Ubuntugrub2-unsigneddeb18.042.06-2ubuntu14.1Not reportedUBUNTU-CVE-2022-28735Not reported
Ubuntugrub2-signeddeb20.041.187.3~20.04.1Not reportedUBUNTU-CVE-2022-28735Not reported
Ubuntugrub2-unsigneddeb20.042.06-2ubuntu14.1Not reportedUBUNTU-CVE-2022-28735Not reported
Ubuntugrub2-signeddeb22.041.187.3~22.04.1Not reportedUBUNTU-CVE-2022-28735Not reported
Ubuntugrub2-unsigneddeb22.042.06-2ubuntu14.1Not reportedUBUNTU-CVE-2022-28735Not reported

[Debian bug #1001057]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [grub2]Fixed
    Details (3)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (6)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (6)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • [grub-efi]Fixed

    Source package: [grub2]

    Details (6)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • [grub-emu]Fixed

    Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

  • Source package: [grub2]

    Details (3)
    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.06-3

      dsa · grub2 · debian · bookworm

Next results

Observed:

References