The vulnerability in the implementation of the grub_script_function_create() function of the Grub2 operating system allows a perpetrator to gain access to confidential data, affect the integrity of the data, and cause service failures.

🗓️ 19 Aug 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Vulnerability in grub_script_function_create in Grub2 enables data access, integrity compromise, and service failures.

Reporter	Title	Published	Views	Family All 175
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	26 Mar 202504:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Packet Capture is vulnerable to Using Components with Known Vulnerabilities	30 Oct 202016:18	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0064: grub2 (ALINUX3-SA-2022:0064)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : grub2 (CESA-2020:3216)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 7 : grub2 (RHSA-2020:3217)	31 Jul 202000:00	–	nessus
Tenable Nessus	Debian DSA-4735-1 : grub2 - security update	30 Jul 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2020-1853)	28 Aug 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : grub2 (EulerOS-SA-2020-2000)	29 Sep 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.9.1 : grub2 (EulerOS-SA-2021-1601)	10 Mar 202100:00	–	nessus
Tenable Nessus	GLSA-202104-05 : GRUB: Multiple vulnerabilities	3 May 202100:00	–	nessus

Vulners

Node

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

OR

novell opensuse_leapMatch15.1

OR

novell opensuse_leapMatch15.2

OR

erich_boleyn grub2Range≤2.04

Source	Link
access	www.access.redhat.com/security/cve/cve-2020-15706
lists	www.lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
lists	www.lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html
lists	www.lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-15706
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-15706
ubuntu	www.ubuntu.com/security/notices/USN-4432-1
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20200807SE16MD
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16

21 Nov 2023 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 24.4

CVSS 35.9

EPSS0.00977

grub2 grub script function vulnerability data access integrity compromise service failures function overriding grub loader