6.4 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
0.0004 Low
EPSS
Percentile
13.3%
In grub2 versions before 2.06 the grub memory allocator doesn’t check for
possible arithmetic overflows on the requested allocation size. This leads
the function to return invalid memory allocations which can be further used
to cause possible integrity, confidentiality and availability impacts
during the boot process.
Author | Note |
---|---|
alexmurray | grub2-signed is not supported in Ubuntu 12.04 ESM (precise/esm) and so marking the priority for grub2 in this release as low |
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | grub2 | < 2.02-2ubuntu8.16 | UNKNOWN |
ubuntu | 20.04 | noarch | grub2 | < 2.04-1ubuntu26.1 | UNKNOWN |
ubuntu | 14.04 | noarch | grub2 | < 2.02~beta2-9ubuntu1.20) Available with Ubuntu Pro or Ubuntu Pro (Infra-only | UNKNOWN |
ubuntu | 16.04 | noarch | grub2 | < 2.02~beta2-36ubuntu3.26 | UNKNOWN |
ubuntu | 18.04 | noarch | grub2-signed | < 1.93.18 | UNKNOWN |
ubuntu | 20.04 | noarch | grub2-signed | < 1.142.3 | UNKNOWN |
ubuntu | 14.04 | noarch | grub2-signed | < 1.34.22) Available with Ubuntu Pro or Ubuntu Pro (Infra-only | UNKNOWN |
ubuntu | 16.04 | noarch | grub2-signed | < 1.66.26 | UNKNOWN |
ubuntu | 18.04 | noarch | grub2-unsigned | < 2.04-1ubuntu47.4 | UNKNOWN |
ubuntu | 20.04 | noarch | grub2-unsigned | < 2.04-1ubuntu47.4 | UNKNOWN |
launchpad.net/bugs/cve/CVE-2020-14308
lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
nvd.nist.gov/vuln/detail/CVE-2020-14308
security-tracker.debian.org/tracker/CVE-2020-14308
ubuntu.com/security/notices/USN-4432-1
wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
www.cve.org/CVERecord?id=CVE-2020-14308
www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
www.openwall.com/lists/oss-security/2020/07/29/3
6.4 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
0.0004 Low
EPSS
Percentile
13.3%