CVE-2020-15705
Medium
Description
GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.
SeverityMedium
CVSS6.4
Exploit probability—
Product
Gnu Grub2
PublishedJul 29, 2020
First seenJul 29, 2020
Weakness typeCWE-347CWE-347
How to fix
Vendor advisories
- wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
- debian.org/security/2020-GRUB-UEFI-SecureBoot
- access.redhat.com/security/vulnerabilities/grub2bootloader
- suse.com/c/suse-addresses-grub2-secure-boot-issue/
- suse.com/support/kb/doc/?id=000019673
- usn.ubuntu.com/4432-1/
- security.gentoo.org/glsa/202104-05
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnu grub2 | v ≤ 2.04 | — |
| redhat enterprise_linux_atomic_host | No range specified | — |
| redhat openshift_container_platform | 4.0 | — |
| canonical ubuntu_linux | 14.04, 16.04, 18.04, 20.04 | — |
| debian debian_linux | 10.0 | — |
| opensuse leap | 15.1, 15.2 | — |
| redhat enterprise_linux | 7.0, 8.0 | — |
| suse suse_linux_enterprise_server | 11, 12, 15 | — |
| microsoft windows_10 | No range specified, 1607, 1709, 1803, 1809, 1903, 1909, 2004 | — |
| microsoft windows_8.1 | No range specified | — |
| microsoft windows_rt_8.1 | No range specified | — |
| microsoft windows_server_2012 | No range specified, r2 | — |
| microsoft windows_server_2016 | No range specified, 1903, 1909, 2004 | — |
| microsoft windows_server_2019 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.