CVE-2020-27749

A flaw was found in grub2 in versions prior to 2.06. Variable names present
are expanded in the supplied command line into their corresponding variable
contents, using a 1kB stack buffer for temporary storage, without
sufficient bounds checking. If the function is called with a command line
that references a variable with a sufficiently large payload, it is
possible to overflow the stack buffer, corrupt the stack frame and control
execution which could also circumvent Secure Boot protections. The highest
threat from this vulnerability is to data confidentiality and integrity as
well as system availability.

Notes