Lucene search

K
certCERTVU:174059
HistoryJul 29, 2020 - 12:00 a.m.

GRUB2 bootloader is vulnerable to buffer overflow

2020-07-2900:00:00
www.kb.cert.org
54

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

28.2%

Overview

The GRUB2 boot loader is vulnerable to buffer overflow, which results in arbitrary code execution during the boot process, even when Secure Boot is enabled.

Description

GRUB2 is a multiboot boot loader that replaced GRUB Legacy in 2012. A boot loader is the first program that runs upon boot and loads the operating system. Many vendors also use a shim, a signed software package that contains the vendor’s certificate and code that verifies and runs the boot loader. This means that firmware Certificate Authority providers can just sign the shim as opposed to all of the other supported programs.

GRUB2 is vulnerable to a buffer overflow when parsing content from the GRUB2 configuration file (grub.cfg). This configuration file is an external file commonly located in the EFI System Partition and can therefore be modified by an attacker with administrator privileges without altering the integrity of the signed vendor shim and GRUB2 boot loader executables. This could allow an authenticated, local attacker to modify the contents of the GRUB2 configuration file to ensure that the attacker’s chosen code is run before the operating system is loaded. This could allow the attacker to gain persistence on the device, even with Secure Boot enabled. All versions of GRUB2 that load commands from an external grub.cfg configuration file are vulnerable.

Impact

An authenticated, local attacker could modify the contents of the GRUB2 configuration file to execute arbitrary code that bypasses signature verification. This could allow the attacker to gain persistence on the device, even with Secure Boot enabled. Because the attacker’s code runs before the operating system, the attacker could control how the operating system is loaded, directly patch the operating system, or even direct the bootloader to alternate OS images. All versions of GRUB2 that load commands from an external grub.cfg configuration file are vulnerable.

Solution

Apply an update if operationally feasible

Update GRUB2 to the latest version to address this vulnerability when operationally feasible. Some patches were originally reported to leave systems unbootable so users are encouraged to review and test patches prior to implementing them. Linux distributions and other vendors using GRUB2 will need to update their installers, boot loaders, and shims. New shims will need to be signed by the Microsoft 3rd Party UEFI Certificate Authority. Administrators of affected devices will need to update installed versions of operating systems as well as installer images, including disaster recovery media. Until all affected versions are added to the dbx revocation list, an attacker would be able to use a vulnerable version of shim and GRUB2. Eventually the UEFI revocation list (dbx) needs to be updated in the firmware of each affected system to prevent running this vulnerable code during boot.

Acknowledgements

Thanks to Mickey Shkatov and Jesse Michael from Eclypsium for reporting this vulnerability.

This document was written by Madison Oliver.

Vendor Information

174059

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

CentOS __ Affected

Updated: 2020-07-31 CVE-2020-10713 Affected

Vendor Statement

We have not received a statement from the vendor.

References

Debian GNU/Linux __ Affected

Updated: 2020-07-31 CVE-2020-10713 Affected

Vendor Statement

We have not received a statement from the vendor.

References

GNU Grub Affected

Updated: 2020-07-29 CVE-2020-10713 Affected

Vendor Statement

We have not received a statement from the vendor.

Microsoft __ Affected

Updated: 2020-07-31 CVE-2020-10713 Affected

Vendor Statement

We have not received a statement from the vendor.

References

Red Hat Inc. __ Affected

Updated: 2020-07-30 CVE-2020-10713 Affected

Vendor Statement

We have not received a statement from the vendor.

References

SUSE Linux __ Affected

Updated: 2020-07-31 CVE-2020-10713 Affected

Vendor Statement

We have not received a statement from the vendor.

References

Ubuntu __ Affected

Updated: 2020-07-31 CVE-2020-10713 Affected

Vendor Statement

We have not received a statement from the vendor.

References

VMware __ Affected

Updated: 2020-07-31 CVE-2020-10713 Affected

Vendor Statement

We have not received a statement from the vendor.

References

References

Other Information

CVE IDs: CVE-2020-10713
Date Public: 2020-07-29 Date First Published:

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

28.2%