The vulnerability affects the implementation of the Secure Boot protocol for operating system bootloaders like Grub2. This allows attackers to execute arbitrary code and gain full control over the device.

🗓️ 23 Sep 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Grub2 Secure Boot signature verification flaw allows arbitrary code execution and full device control.

Reporter	Title	Published	Views	Family All 164
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	26 Mar 202504:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Packet Capture is vulnerable to Using Components with Known Vulnerabilities	30 Oct 202016:18	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0026: grub2 (ALINUX3-SA-2021:0026)	14 May 202500:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0064: grub2 (ALINUX3-SA-2022:0064)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : grub2 (CESA-2020:3216)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 7 : grub2 (RHSA-2020:3217)	31 Jul 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : grub2 (EulerOS-SA-2020-2000)	29 Sep 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : grub2 (EulerOS-SA-2022-1008)	28 Jan 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : grub2 (EulerOS-SA-2022-1028)	28 Jan 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2022-1194)	23 Feb 202200:00	–	nessus

Vulners

Node

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

OR

novell opensuse_leapMatch15.1

OR

novell opensuse_leapMatch15.2

OR

erich_boleyn grub2Range≤2.04

Source	Link
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-grub-/
git	www.git.savannah.gnu.org/gitweb/
access	www.access.redhat.com/security/cve/cve-2020-15705
debian	www.debian.org/security/2020-GRUB-UEFI-SecureBoot/
lists	www.lists.opensuse.org/archives/list/[email protected]/message/VHOMHHK6YNMLF2MBP6E2P2NPYVKF47G6/
lists	www.lists.opensuse.org/archives/list/[email protected]/message/UGKES3MGRD44EG6DD3EOHLZZXMVRVSC3/
ubuntu	www.ubuntu.com/security/notices/USN-4432-1
openwall	www.openwall.com/lists/oss-security/2020/07/29/3
openwall	www.openwall.com/lists/oss-security/2021/03/02/3
openwall	www.openwall.com/lists/oss-security/2021/09/17/2

28 Sep 2022 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 26

CVSS 36.4

EPSS0.01434

Grub bootloader Secure boot signature verification arbitrary code execution device control