CVE-2020-14311

2020-07-3120:56:30

CWE-122

CWE-190

redhat

www.cve.org

CVSS3

5.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

19.0%

JSON

There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow.

CNA Affected

[
  {
    "product": "grub2",
    "vendor": "The Grub2 Project",
    "versions": [
      {
        "status": "affected",
        "version": "2.06"
      }
    ]
  }
]