EulerOS Virtualization 3.0.6.6 : grub2 (EulerOS-SA-2020-2462)

According to the version of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process CVE-2020-10713 Note that Tenable Network Securi...

Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2020-2462)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 3.0.2.2 : grub2 (EulerOS-SA-2020-2184)

According to the version of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification...

PT-2020-6593

Name of the Vulnerable Software and Affected Versions grub2 versions prior to 2.06 Description A flaw was found in grub2 during USB device initialization, where descriptors are read with very little bounds checking, assuming the USB device provides sane values. If properly exploited, an attacker...

Important: Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update

An update for cockpit-ovirt, imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

RHEL 8 : Red Hat Virtualization (RHSA-2020:4172)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4172 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host,...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a GNU GRUB2 security vulnerability (CVE-2020-10713)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in GNU GRUB2 that could allow a local authenticated attacker to execute arbitrary code on the system. CVE-2020-10713 Vulnerability Details CVEID: CVE-2020-10713 Description: GNU GRUB2 could allow a local authenticated...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a GNU GRUB2 security vulnerability (CVE-2020-10713)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in GNU GRUB2 that could allow a local authenticated attacker to execute arbitrary code on the system. CVE-2020-10713 Vulnerability Details CVEID: CVE-2020-10713 Description: GNU GRUB2 could allow a local authenticated...

VulnCheck KEV: CVE-2020-10713

A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access...

Important: Red Hat Security Advisory: redhat-release-virtualization-host and redhat-virtualization-host security update

An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...

RHEL 7 : redhat--virtualization-host and redhat-virtualization-host (RHSA-2020:4115)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4115 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host,...

EulerOS Virtualization for ARM 64 3.0.6.0 : grub2 (EulerOS-SA-2020-2000)

According to the versions of the grub2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Integer overflows were discovered in the functions grubcmdinitrd and grubinitrdinit in the efilinux component of GRUB2,...

Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2020-2000)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 31 : 1:grub2 (2020-e19b87f4f5)

grub2 updates for boothole vulnerabilities in f31/f32. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX leading to read_section_as_string() to an arithmetic overflow zero-sized allocation and further heap-based buffer overflow.

...

Security Advisory - Buffer Overflow Vulnerability BootHole in GRUB2 Secure Boot

Eclypsium researchers have discovered a vulnerability named“BootHole”in the GRUB2 bootloader. There is a buffer overflow vulnerability that can be used to gain arbitrary code execution during the boot process, even when Secure Boot is enabled. Attackers exploiting this vulnerability can install...

PT-2020-6586

Name of the Vulnerable Software and Affected Versions grub2 versions prior to 2.06 Description A flaw was found in the rmmod implementation of grub2, allowing the unloading of a module used as a dependency without checking if any other dependent module is still loaded, leading to a use-after-free...

Fedora 32 : 1:grub2 (2020-41e57d7649)

grub2 updates for boothole vulnerabilities in f31/f32. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

SUSE-SU-2020:2629-1 Security update for shim

This update for shim fixes the following issues: This update addresses the 'BootHole' security issue master CVE CVE-2020-10713, by disallowing binaries signed by the previous SUSE UEFI signing key from booting. This update should only be installed after updates of grub2, the Linux kernel and if...

SUSE-SU-2020:2627-1 Security update for shim

This update for shim fixes the following issues: - Update to the unified shim binary from SUSE Linux Enterprise 15-SP1 bsc1168994 This update addresses the 'BootHole' security issue master CVE CVE-2020-10713, by disallowing binaries signed by the previous SUSE UEFI signing key from booting. This...