CVE-2022-28734 Out-of-bounds write when handling split HTTP headers

High 8.1 Published 20 Jul 2023 Updated 13 Feb 2025

An out-of-bounds write in GRUB2's HTTP header handling allows attackers to corrupt memory and potentially execute code or escalate privileges.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-28734?

CVE-2022-28734 is a high-severity memory corruption vulnerability in Netapp Active Iq Unified Manager, published on 20 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NULL byte past the buffer. It's conceivable that an attacker controlled set of packets can lead to corruption of the GRUB2's internal memory metadata.

Weakness: CWE-787

Which versions are affected by CVE-2022-28734?

It affects 2 products.

Products include Gnu Grub2, Netapp Active Iq Unified Manager.

How do I fix CVE-2022-28734?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-28734 being exploited?

There is no known exploitation of CVE-2022-28734 in the wild and no public exploit code.

All Netapp Active Iq Unified Manager vulnerabilities

Sources

Also known as AZL-27552, AZL-34789, DEBIAN-CVE-2022-28734, GHSA-h8v2-pvw7-3jf5, UBUNTU-CVE-2022-28734.