A malicious crafted IP packet can lead to a integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may ending up wrapping around to a small integer number which will be used in memory allocation. If the attack succeeds in such way, subsequent operations can write past the end of the buffer.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2022:5098 https://access.redhat.com/errata/RHSA-2022:5098
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2022:5096 https://access.redhat.com/errata/RHSA-2022:5096
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:5099 https://access.redhat.com/errata/RHSA-2022:5099
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:5095 https://access.redhat.com/errata/RHSA-2022:5095
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2022:5100 https://access.redhat.com/errata/RHSA-2022:5100
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-28733
This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Via RHSA-2022:5678 https://access.redhat.com/errata/RHSA-2022:5678
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2022:8900 https://access.redhat.com/errata/RHSA-2022:8900