CVE-2022-28733

What it actually does

Integer underflow in grub_net_recv_ip4_packets allows a crafted IPv4 packet to cause total_len to wrap to a small value, resulting in undersized memory allocation followed by out-of-bounds writes past the buffer end.

Why it matters to the business

Attackers can achieve remote code execution or denial of service on systems that perform network boot or PXE operations with GRUB2, risking full host compromise or boot-time system failure; no downstream dependents or ransomware use reported.

How an attack unfolds

An attacker sends a maliciously crafted IPv4 packet to a target running GRUB2's network stack; the underflow in total_len produces an undersized buffer; subsequent packet processing writes beyond the allocation, enabling control-flow hijacking or crash.

How to fix it

Upgrade GRUB2 to a patched release that corrects the integer underflow in grub_net_recv_ip4_packets; until patches are available, disable network boot features or restrict network access to trusted boot servers only.

How to confirm the fix worked

Confirm GRUB2 source or binary contains the corrected length checks in grub_net_recv_ip4_packets; test boot with both benign and crafted IPv4 packets to verify no underflow or overflow occurs.

Typical attack path

1. Identify systems using GRUB2 network functionality (PXE, TFTP, HTTP boot)
2. Craft and transmit IPv4 packets that trigger the total_len underflow
3. Trigger buffer overflow during grub_net_recv_ip4_packets processing
4. Achieve arbitrary code execution or denial of service in the bootloader context

How to detect it

Examine boot logs, PXE server logs, and network captures for malformed IPv4 packets targeting GRUB2 network receive functions; look for unexpected bootloader crashes or memory corruption artifacts during network boot attempts.

What your security team should do

• Prioritize patching GRUB2 on all PXE and network-boot infrastructure immediately upon release of fixed packages
• Inventory systems relying on GRUB network stack and restrict their exposure to untrusted networks
• Monitor vendor advisories for GRUB2 updates and test upgrades in isolated boot environments