How severe is CVE-2022-3675?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 5.5 out of 10.

What type of vulnerability is CVE-2022-3675?

This is classified as CWE-20, which is a common weakness in software security.

CVE-2022-3675 - MEDIUM Severity | CVSS 5.5

Vulnerability Description

Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB command-line, modify kernel command-line arguments, or boot non-default OSTree deployments. Recent Fedora CoreOS releases have a misconfiguration which allows booting non-default OSTree deployments without entering a password. This allows someone with access to the GRUB menu to boot into an older version of Fedora CoreOS, reverting any security fixes that have recently been applied to the machine. A password is still required to modify kernel command-line arguments and to access the GRUB command line.

Related Vulnerabilities

CVE-2008-7316

MEDIUM

CVSS:5.5(Medium)

mm/filemap.c in the Linux kernel before 2.6.25 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers an iovec of zero length, followed by a page fault ...

CWE-202008

CVE-2010-3049

MEDIUM

CVSS:5.5(Medium)

Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot).

CWE-202010

CVE-2010-3293

MEDIUM

CVSS:5.5(Medium)

mailscanner can allow local users to prevent virus signatures from being updated

CWE-202010

CVE-2010-3373

MEDIUM

CVSS:5.5(Medium)

paxtest handles temporary files insecurely

CWE-202010

CVE-2010-5328

MEDIUM

CVSS:5.5(Medium)

include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group ID of zero from reaching the swapper process, which allows local users to cause a denial of se...

CWE-202010

CVE-2011-0220

MEDIUM

CVSS:5.5(Medium)

Apple Bonjour before 2011 allows a crash via a crafted multicast DNS packet.

CWE-202011