Every CVE Search/ Get API key

CVE-2022-34301

A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this...

6.7 MediumPublic exploit

A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.99%Down 1.5 points since Aug 27, 2022
90%50%10%1%

What each source reports

NVD Score used 6.7

A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.

Record
CVE-2022-34301
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
CVE List No score

A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.

Record
CVE-2022-34301
Updated
2026-11-02
EUVDEUVD-2022-37258 No score

A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.

Record
EUVD-2022-37258
Updated
2026-11-03
GitHub AdvisoriesGHSA-7j33-663j-fx7f 6.7

A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this...

A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.

Record
GHSA-7j33-663j-fx7f
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:2487 7.5

Red Hat Security Advisory: fwupd security and bug fix update

Record
RHSA-2023:2487
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2023:2487 No score

Moderate: fwupd security and bug fix update

The fwupd packages provide a service that allows session software to update device firmware.

Security Fix(es):

  • fwupd: world readable password in /etc/fwupd/redfish.conf (CVE-2022-3287)
  • shim: 3rd party shim allow secure boot bypass (CVE-2022-34301)
  • shim: 3rd party shim allow secure boot bypass (CVE-2022-34302)
  • shim: 3rd party shim allow secure boot bypass (CVE-2022-34303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2023:2487
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fwupd
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.8.10-2.el9.alma
1.8.10-2.el9.alma
fwupd-devel
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.8.10-2.el9.alma
1.8.10-2.el9.alma
fwupd-plugin-flashrom
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.8.10-2.el9.alma
1.8.10-2.el9.alma
fwupd-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
fwupd-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
fwupd-plugin-flashrom
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
fwupd-plugin-flashrom-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
fwupd-tests-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
fwupd
Red Hat:enterprise_linux:9::baseos
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
fwupd-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
Show 8 moreShow less
Affected packages
PackageAffectedFixed
fwupd-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
fwupd-plugin-flashrom-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
fwupd-tests-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
fwupd-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
fwupd-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
fwupd-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
fwupd-plugin-flashrom-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9
fwupd-tests-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 4 CVEs
 before 0:1.8.10-2.el9
0:1.8.10-2.el9

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubTheMalwareGuardian/CVE-2022-343012026-09-07

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-34301 is a medium vulnerability (CVSS 6.7) in Kidan Cryptopro Securedisk For Bitlocker, published August 26, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.99%, the 62nd percentile. No source names a fixed version.

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open