Security update for grub2

SUSE Security Update: Security update for grub2

---

Announcement ID:	SUSE-SU-2022:4218-1
Rating:	important
References:	#1205178 #1205182
Cross-References:	CVE-2022-2601 CVE-2022-3775
Affected Products:	SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Manager Proxy 4.1 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1

---

An update that fixes two vulnerabilities is now available.

Description:

This update for grub2 fixes the following issues:

• CVE-2022-2601: Fixed buffer overflow in grub_font_construct_glyph (bsc#1205178).
• CVE-2022-3775: Fixed integer underflow in blit_comb() (bsc#1205182).

Other:

• Bump upstream SBAT generation to 3

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Manager Server 4.1:
  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-4218=1
• SUSE Manager Retail Branch Server 4.1:
  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-4218=1
• SUSE Manager Proxy 4.1:
  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-4218=1
• SUSE Linux Enterprise Server for SAP 15-SP2:
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-4218=1
• SUSE Linux Enterprise Server 15-SP2-LTSS:
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-4218=1
• SUSE Linux Enterprise Server 15-SP2-BCL:
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-4218=1
• SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS:
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-4218=1
• SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS:
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-4218=1
• SUSE Enterprise Storage 7:
  zypper in -t patch SUSE-Storage-7-2022-4218=1

Package List:

• SUSE Manager Server 4.1 (ppc64le s390x x86_64):
  • grub2-2.04-150200.9.68.1
  • grub2-debuginfo-2.04-150200.9.68.1
• SUSE Manager Server 4.1 (s390x x86_64):
  • grub2-debugsource-2.04-150200.9.68.1
• SUSE Manager Server 4.1 (noarch):
  • grub2-arm64-efi-2.04-150200.9.68.1
  • grub2-i386-pc-2.04-150200.9.68.1
  • grub2-powerpc-ieee1275-2.04-150200.9.68.1
  • grub2-snapper-plugin-2.04-150200.9.68.1
  • grub2-systemd-sleep-plugin-2.04-150200.9.68.1
  • grub2-x86_64-efi-2.04-150200.9.68.1
  • grub2-x86_64-xen-2.04-150200.9.68.1
• SUSE Manager Server 4.1 (s390x):
  • grub2-s390x-emu-2.04-150200.9.68.1
• SUSE Manager Retail Branch Server 4.1 (noarch):
  • grub2-arm64-efi-2.04-150200.9.68.1
  • grub2-i386-pc-2.04-150200.9.68.1
  • grub2-snapper-plugin-2.04-150200.9.68.1
  • grub2-systemd-sleep-plugin-2.04-150200.9.68.1
  • grub2-x86_64-efi-2.04-150200.9.68.1
  • grub2-x86_64-xen-2.04-150200.9.68.1
• SUSE Manager Retail Branch Server 4.1 (x86_64):
  • grub2-2.04-150200.9.68.1
  • grub2-debuginfo-2.04-150200.9.68.1
  • grub2-debugsource-2.04-150200.9.68.1
• SUSE Manager Proxy 4.1 (x86_64):
  • grub2-2.04-150200.9.68.1
  • grub2-debuginfo-2.04-150200.9.68.1
  • grub2-debugsource-2.04-150200.9.68.1
• SUSE Manager Proxy 4.1 (noarch):
  • grub2-arm64-efi-2.04-150200.9.68.1
  • grub2-i386-pc-2.04-150200.9.68.1
  • grub2-snapper-plugin-2.04-150200.9.68.1
  • grub2-systemd-sleep-plugin-2.04-150200.9.68.1
  • grub2-x86_64-efi-2.04-150200.9.68.1
  • grub2-x86_64-xen-2.04-150200.9.68.1
• SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64):
  • grub2-2.04-150200.9.68.1
  • grub2-debuginfo-2.04-150200.9.68.1
• SUSE Linux Enterprise Server for SAP 15-SP2 (x86_64):
  • grub2-debugsource-2.04-150200.9.68.1
• SUSE Linux Enterprise Server for SAP 15-SP2 (noarch):
  • grub2-arm64-efi-2.04-150200.9.68.1
  • grub2-i386-pc-2.04-150200.9.68.1
  • grub2-powerpc-ieee1275-2.04-150200.9.68.1
  • grub2-snapper-plugin-2.04-150200.9.68.1
  • grub2-systemd-sleep-plugin-2.04-150200.9.68.1
  • grub2-x86_64-efi-2.04-150200.9.68.1
  • grub2-x86_64-xen-2.04-150200.9.68.1
• SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64):
  • grub2-2.04-150200.9.68.1
  • grub2-debuginfo-2.04-150200.9.68.1
• SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 s390x x86_64):
  • grub2-debugsource-2.04-150200.9.68.1
• SUSE Linux Enterprise Server 15-SP2-LTSS (noarch):
  • grub2-arm64-efi-2.04-150200.9.68.1
  • grub2-i386-pc-2.04-150200.9.68.1
  • grub2-powerpc-ieee1275-2.04-150200.9.68.1
  • grub2-snapper-plugin-2.04-150200.9.68.1
  • grub2-systemd-sleep-plugin-2.04-150200.9.68.1
  • grub2-x86_64-efi-2.04-150200.9.68.1
  • grub2-x86_64-xen-2.04-150200.9.68.1
• SUSE Linux Enterprise Server 15-SP2-LTSS (s390x):
  • grub2-s390x-emu-2.04-150200.9.68.1
• SUSE Linux Enterprise Server 15-SP2-BCL (noarch):
  • grub2-arm64-efi-2.04-150200.9.68.1
  • grub2-i386-pc-2.04-150200.9.68.1
  • grub2-snapper-plugin-2.04-150200.9.68.1
  • grub2-systemd-sleep-plugin-2.04-150200.9.68.1
  • grub2-x86_64-efi-2.04-150200.9.68.1
  • grub2-x86_64-xen-2.04-150200.9.68.1
• SUSE Linux Enterprise Server 15-SP2-BCL (x86_64):
  • grub2-2.04-150200.9.68.1
  • grub2-debuginfo-2.04-150200.9.68.1
  • grub2-debugsource-2.04-150200.9.68.1
• SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64):
  • grub2-2.04-150200.9.68.1
  • grub2-debuginfo-2.04-150200.9.68.1
  • grub2-debugsource-2.04-150200.9.68.1
• SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch):
  • grub2-arm64-efi-2.04-150200.9.68.1
  • grub2-i386-pc-2.04-150200.9.68.1
  • grub2-snapper-plugin-2.04-150200.9.68.1
  • grub2-systemd-sleep-plugin-2.04-150200.9.68.1
  • grub2-x86_64-efi-2.04-150200.9.68.1
  • grub2-x86_64-xen-2.04-150200.9.68.1
• SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64):
  • grub2-2.04-150200.9.68.1
  • grub2-debuginfo-2.04-150200.9.68.1
  • grub2-debugsource-2.04-150200.9.68.1
• SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch):
  • grub2-arm64-efi-2.04-150200.9.68.1
  • grub2-i386-pc-2.04-150200.9.68.1
  • grub2-snapper-plugin-2.04-150200.9.68.1
  • grub2-systemd-sleep-plugin-2.04-150200.9.68.1
  • grub2-x86_64-efi-2.04-150200.9.68.1
  • grub2-x86_64-xen-2.04-150200.9.68.1
• SUSE Enterprise Storage 7 (aarch64 x86_64):
  • grub2-2.04-150200.9.68.1
  • grub2-debuginfo-2.04-150200.9.68.1
  • grub2-debugsource-2.04-150200.9.68.1
• SUSE Enterprise Storage 7 (noarch):
  • grub2-arm64-efi-2.04-150200.9.68.1
  • grub2-i386-pc-2.04-150200.9.68.1
  • grub2-snapper-plugin-2.04-150200.9.68.1
  • grub2-systemd-sleep-plugin-2.04-150200.9.68.1
  • grub2-x86_64-efi-2.04-150200.9.68.1
  • grub2-x86_64-xen-2.04-150200.9.68.1

References:

• https://www.suse.com/security/cve/CVE-2022-2601.html
• https://www.suse.com/security/cve/CVE-2022-3775.html
• https://bugzilla.suse.com/1205178
• https://bugzilla.suse.com/1205182