{"cve":"CVE-2022-3675","nvd":{"published":"2022-11-03T18:15:14.627","modified":"2026-06-17T04:59:59.683","status":"Modified","description":"Fedora CoreOS supports setting a GRUB bootloader password\nusing a Butane config. When this feature is enabled, GRUB requires a password to access the\nGRUB command-line, modify kernel command-line arguments, or boot\nnon-default OSTree deployments.  Recent Fedora CoreOS releases have a\nmisconfiguration which allows booting non-default OSTree deployments\nwithout entering a password.  This allows someone with access to the\nGRUB menu to boot into an older version of Fedora CoreOS, reverting\nany security fixes that have recently been applied to the machine.  A\npassword is still required to modify kernel command-line arguments and\nto access the GRUB command line.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":5.5},"cwes":["CWE-306","CWE-20"],"references":["https://docs.fedoraproject.org/en-US/fedora-coreos/grub-password/","https://github.com/coreos/fedora-coreos-tracker/issues/1333","https://lists.fedoraproject.org/archives/list/coreos-status@lists.fedoraproject.org/thread/NHUCNH5Y4UH5DPUCXISYXXVA563TLFEJ/","https://docs.fedoraproject.org/en-US/fedora-coreos/grub-password/","https://github.com/coreos/fedora-coreos-tracker/issues/1333"],"products":["redhat:fedora_coreos"],"source":"nvd","synced_at":"2026-10-19T21:37:08.729216836+00:00"},"epss":{"cve":"CVE-2022-3675","score":0.00185,"percentile":0.08063,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}