CVE-2020-25632

2021-03-0200:00:00

ubuntu.com

0.0004 Low

EPSS

Percentile

5.2%

JSON

A flaw was found in grub2 in versions prior to 2.06. The rmmod
implementation allows the unloading of a module used as a dependency
without checking if any other dependent module is still loaded leading to a
use-after-free scenario. This could allow arbitrary code to be executed or
a bypass of Secure Boot protections. The highest threat from this
vulnerability is to data confidentiality and integrity as well as system
availability.

Notes

Author	Note
alexmurray	CVE title: “grub2: use-after-free in rmmod command”
sbeattie	grub2-unsigned will contain fixes and supersede grub2, which will contain only BIOS grub bits.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchgrub2-signed< 1.167~18.04.5UNKNOWN
ubuntu20.04noarchgrub2-signed< 1.167.2UNKNOWN
ubuntu20.10noarchgrub2-signed< 1.167.2UNKNOWN
ubuntu21.04noarchgrub2-signed< 1.164UNKNOWN
ubuntu21.10noarchgrub2-signed< 1.169UNKNOWN
ubuntu14.04noarchgrub2-signed< anyUNKNOWN
ubuntu16.04noarchgrub2-signed< 1.164UNKNOWN
ubuntu18.04noarchgrub2-unsigned< 2.04-1ubuntu44.1.2UNKNOWN
ubuntu20.04noarchgrub2-unsigned< 2.04-1ubuntu44.2UNKNOWN
ubuntu20.10noarchgrub2-unsigned< 2.04-1ubuntu44.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	grub2-signed	< 1.167~18.04.5	UNKNOWN
ubuntu	20.04	noarch	grub2-signed	< 1.167.2	UNKNOWN
ubuntu	20.10	noarch	grub2-signed	< 1.167.2	UNKNOWN
ubuntu	21.04	noarch	grub2-signed	< 1.164	UNKNOWN
ubuntu	21.10	noarch	grub2-signed	< 1.169	UNKNOWN
ubuntu	14.04	noarch	grub2-signed	< any	UNKNOWN
ubuntu	16.04	noarch	grub2-signed	< 1.164	UNKNOWN
ubuntu	18.04	noarch	grub2-unsigned	< 2.04-1ubuntu44.1.2	UNKNOWN
ubuntu	20.04	noarch	grub2-unsigned	< 2.04-1ubuntu44.2	UNKNOWN
ubuntu	20.10	noarch	grub2-unsigned	< 2.04-1ubuntu44.2	UNKNOWN