SUSE-SU-2020:2171-1 Security update for xen

This update for xen fixes the following issues: - bsc1174543 - secure boot related fixes - bsc1163019 - CVE-2020-8608: Potential OOB access due to unsafe snprintf usages...

SUSE-SU-2020:2166-1 Security update for xen

This update for xen fixes the following issues: - bsc1174543 - secure boot related fixes - bsc1172356 - Not able to hot-plug NIC via virt-manager, asks to attach on next reboot while it should be live attached...

SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:2160-1)

This update for xen fixes the following issues : bsc1174543 - secure boot related fixes bsc1172356 - Not able to hot-plug NIC via virt-manager, asks to attach on next reboot while it should be live attached Note that Tenable Network Security has extracted the preceding description block directly...

SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:2158-1)

This update for xen fixes the following issues : bsc1174543 - secure boot related fixes bsc1172356 - Not able to hot-plug NIC via virt-manager, asks to attach on next reboot while it should be live attached Note that Tenable Network Security has extracted the preceding description block directly...

SUSE SLES12 Security Update : xen (SUSE-SU-2020:2141-1)

This update for xen fixes the following issues : bsc1174543 - secure boot related fixes bsc1163019 - CVE-2020-8608: Potential OOB access due to unsafe snprintf usages Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable...

SUSE-SU-2020:2160-1 Security update for xen

This update for xen fixes the following issues: - bsc1174543 - secure boot related fixes - bsc1172356 - Not able to hot-plug NIC via virt-manager, asks to attach on next reboot while it should be live attached...

SUSE-SU-2020:2159-1 Security update for xen

This update for xen fixes the following issues: - bsc1174543 - secure boot related fixes - bsc1172356 - Not able to hot-plug NIC via virt-manager, asks to attach on next reboot while it should be live attached...

SUSE-SU-2020:2158-1 Security update for xen

This update for xen fixes the following issues: - bsc1174543 - secure boot related fixes - bsc1172356 - Not able to hot-plug NIC via virt-manager, asks to attach on next reboot while it should be live attached...

SUSE-SU-2020:2141-1 Security update for xen

This update for xen fixes the following issues: - bsc1174543 - secure boot related fixes - bsc1163019 - CVE-2020-8608: Potential OOB access due to unsafe snprintf usages...

SUSE SLES12 Security Update : kernel (SUSE-SU-2020:2121-1)

The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-0305: In cdevget of chardev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : GRUB2 regression (USN-4432-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4432-2 advisory. USN-4432-1 fixed vulnerabilities in GRUB2 affecting Secure Boot environments. Unfortunately, the update introduced regressions for some BI...

Ubuntu: Security Advisory (USN-4432-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4432-2 grub2, grub2-signed regression

USN-4432-1 fixed vulnerabilities in GRUB2 affecting Secure Boot environments. Unfortunately, the update introduced regressions for some BIOS systems either pre-UEFI or UEFI configured in Legacy mode, preventing them from successfully booting. This update addresses the issue. Users with BIOS syste...

USN-4432-2: GRUB2 regression

USN-4432-1 fixed vulnerabilities in GRUB2 affecting Secure Boot environments. Unfortunately, the update introduced regressions for some BIOS systems either pre-UEFI or UEFI configured in Legacy mode, preventing them from successfully booting. This update addresses the issue. Users with BIOS syste...

GRUB2 Arbitrary Code Execution Vulnerability

On July 29, 2020, a research paper titled “There’s a Hole in the Boot” was made publicly available. This paper discusses a vulnerability discovered in the GRand Unified Bootloader version 2 GRUB2 bootloader that may allow an attacker to execute arbitrary code at system boot time. The vulnerabilit...

SUSE-SU-2020:14444-1 Security update for xen

This update for xen fixes the following issues: - bsc1174543 - secure boot related fixes - bsc1163019 - CVE-2020-8608: potential OOB access due to unsafe snprintf usages - bsc1169392 - CVE-2020-11742: Bad continuation handling in GNTTABOPcopy - bsc1168140 - CVE-2020-11740, CVE-2020-11741: multipl...

Vulnerabilities fixed in GRUB2

Researchers have found multiple vulnerabilities in GRUB2. The vulnerability with reference CVE-2020-10713 has been named "Boothole." assigned. This vulnerability allows a malicious person with physical access to the system or a malicious person with administrator privileges able to execute...

GRUB2 Boothole Buffer Overflow Vulnerability (CVE-2020-10713) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR®

On July 29, 2020, Eclypsium researchers disclosed a high-risk vulnerability in GRUB2 GRand Unified Bootloader version 2 affecting billions of Linux and Windows systems, even when secure boot is enabled. CVE-2020-10713 is assigned to this buffer overflow vulnerability, termed as “Boothole”...

grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process

A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access...

grub2: Integer overflow in initrd size handling

Integer overflows were discovered in the functions grubcmdinitrd and grubinitrdinit in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu the functionality is not included in GRUB2 upstream, leading to a heap-based buffer overflow. These could be triggered by an extremely...