There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data.

🗓️ 18 Aug 2020 07:00:00Reported by MicrosoftType

Grub2 before 2.06 mishandles squashfs symlink length UINT32, causing zero alloc and heap overflow.

Reporter	Title	Published	Views	Family All 160
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	26 Mar 202504:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Packet Capture is vulnerable to Using Components with Known Vulnerabilities	30 Oct 202016:18	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0026: grub2 (ALINUX3-SA-2021:0026)	14 May 202500:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0064: grub2 (ALINUX3-SA-2022:0064)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : grub2 (CESA-2020:3216)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 7 : grub2 (RHSA-2020:3217)	31 Jul 202000:00	–	nessus
Tenable Nessus	Debian DSA-4735-1 : grub2 - security update	30 Jul 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2020-1853)	28 Aug 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : grub2 (EulerOS-SA-2020-2000)	29 Sep 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.9.1 : grub2 (EulerOS-SA-2021-1601)	10 Mar 202100:00	–	nessus