6.4 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
46.2%
Integer overflows were discovered in the functions grub_cmd_initrd and
grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian,
Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream),
leading to a heap-based buffer overflow. These could be triggered by an
extremely large number of arguments to the initrd command on 32-bit
architectures, or a crafted filesystem with very large files on any
architecture. An attacker could use this to execute arbitrary code and
bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04
and prior versions.
Author | Note |
---|---|
sbeattie | efilinux: Fix integer overflows in grub_cmd_initrd e961f8f8cdb25245900dc0884047e856346035b3 Title: grub2: integer overflows in efilinux grub_cmd_initrd and grub_initrd_init leads to heap based buffer overflow code is not upstream in grub2 but carried as part of patches by Ubuntu, Debian, Red Hat and possibly others. |
alexmurray | grub2-signed is not supported in Ubuntu 12.04 ESM (precise/esm) and so marking the priority for grub2 in this release as low |
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | grub2 | < 2.02-2ubuntu8.16 | UNKNOWN |
ubuntu | 20.04 | noarch | grub2 | < 2.04-1ubuntu26.1 | UNKNOWN |
ubuntu | 14.04 | noarch | grub2 | < 2.02~beta2-9ubuntu1.20) Available with Ubuntu Pro or Ubuntu Pro (Infra-only | UNKNOWN |
ubuntu | 16.04 | noarch | grub2 | < 2.02~beta2-36ubuntu3.26 | UNKNOWN |
ubuntu | 18.04 | noarch | grub2-signed | < 1.93.18 | UNKNOWN |
ubuntu | 20.04 | noarch | grub2-signed | < 1.142.3 | UNKNOWN |
ubuntu | 14.04 | noarch | grub2-signed | < 1.34.22) Available with Ubuntu Pro or Ubuntu Pro (Infra-only | UNKNOWN |
ubuntu | 16.04 | noarch | grub2-signed | < 1.66.26 | UNKNOWN |
ubuntu | 16.04 | noarch | grub2-unsigned | < any | UNKNOWN |
launchpad.net/bugs/cve/CVE-2020-15707
lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
nvd.nist.gov/vuln/detail/CVE-2020-15707
security-tracker.debian.org/tracker/CVE-2020-15707
ubuntu.com/security/notices/USN-4432-1
wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
www.cve.org/CVERecord?id=CVE-2020-15707
www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
www.openwall.com/lists/oss-security/2020/07/29/3
6.4 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
46.2%