If certificates that signed grub are installed into db grub can be booted directly. It will then boot any kernel without signature validation. The booted kernel will think it was booted in secureboot mode and will implement lockdown yet it could have been tampered. This flaw is a reintroduction of CVE-2020-15705 and only affects grub2 versions prior to 2.06 and upstream and distributions using the shim_lock mechanism.

🗓️ 23 Mar 2021 07:00:00Reported by MicrosoftType

DB certificates let grub boot unsigned kernels, bypass secure boot and lockdown; reintroduces CVE-2020-15705 in grub2 before 2.06 with shim_lock.

Reporter	Title	Published	Views	Family All 188
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	26 Mar 202504:05	–	ibm
IBM Security Bulletins	Security Bulletin: GRUB2 as used by IBM QRadar SIEM is vulnerable to arbitrary code execution	26 Jul 202113:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Packet Capture is vulnerable to Using Components with Known Vulnerabilities	30 Oct 202016:18	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0026: grub2 (ALINUX3-SA-2021:0026)	14 May 202500:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0064: grub2 (ALINUX3-SA-2022:0064)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : grub2 (CESA-2020:3216)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 7 : grub2 (RHSA-2020:3217)	31 Jul 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : grub2 (EulerOS-SA-2020-2000)	29 Sep 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : grub2 (EulerOS-SA-2022-1008)	28 Jan 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : grub2 (EulerOS-SA-2022-1028)	28 Jan 202200:00	–	nessus

Vulners

Node

16 Dec 2021 08:00Current

8.2High risk

Vulners AI Score8.2

CVSS 24.4

CVSS 3.16.4

EPSS0.00067