Redhat: CVE-2022-2601 grub2 - Buffer overflow in grub_font_construct_glyph() can lead to out-of-bound write and possible secure boot bypass

Windows 11, version 24H2 is not generally available yet. Why are there updates for this version of Windows listed in the Security Updates table? The new Copilot+ devices that are now publicly available come with Windows 11, version 24H2 installed. Customers with these devices need to know about any vulnerabilities that affect their machine and to install the updates if they are not receiving automatic updates. Note that the general availability date for Windows 11, version 24H2 is scheduled for later this year.

Why is this Redhat CVE included in the Security Update Guide? The vulnerability assigned to this CVE is in the Linux GRUB2 boot loader, a boot loader designed to support Secure Boot on systems that are running Linux. It is being documented in the Security Update Guide to announce that the latest builds of Windows are no longer vulnerable to this security feature bypass using the Linux GRUB2 boot loader. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

Will this update affect my ability to boot Linux after applying this update? To address this security issue, Windows will apply a Secure Boot Advanced Targeting (SBAT) update to block vulnerable Linux boot loaders that could have an impact on Windows security. The SBAT value is not applied to dual-boot systems that boot both Windows and Linux and should not affect these systems. You might find that older Linux distribution ISOs will not boot. If this occurs, work with your Linux vendor to get an update. Update, September 19, 2024: To address a known issue on systems with dual booting for Windows and Linux, we have reconfigured the manner in which this fix can be applied. Starting with the September 10, 2024 security updates, the fix will not automatically apply the SBAT update to the firmware. Customers who have applied the August 13, 2024 security updates will have the SBAT update in firmware and will be protected. Customers who have devices with Windows system only and who have not applied the August updates and who want to be protected from this issue can either apply the August 13, 2024 updates or apply the September 10, 2024 updates and set the following registry key from an Administrator command prompt: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x400 /f” Update, May 16, 2024: The security updates released on May 13, 2025 apply improvements to SBAT for the detection of Linux systems, and address the known issue with dual booting for Windows and Linux.