CVE-2020-15707
Description
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.
How to fix
- wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
- debian.org/security/2020-GRUB-UEFI-SecureBoot
- access.redhat.com/security/vulnerabilities/grub2bootloader
- suse.com/c/suse-addresses-grub2-secure-boot-issue/
- suse.com/support/kb/doc/?id=000019673
- debian.org/security/2020/dsa-4735
- usn.ubuntu.com/4432-1/
- security.gentoo.org/glsa/202104-05
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnu grub2 | v ≤ 2.04 | — |
| redhat enterprise_linux_atomic_host | No range specified | — |
| redhat openshift_container_platform | 4.0 | — |
| redhat enterprise_linux | 7.0, 8.0 | — |
| microsoft windows_10 | No range specified, 1607, 1709, 1803, 1809, 1903, 1909, 2004 | — |
| microsoft windows_8.1 | No range specified | — |
| microsoft windows_rt_8.1 | No range specified | — |
| microsoft windows_server_2012 | No range specified, r2 | — |
| microsoft windows_server_2016 | No range specified, 1903, 1909, 2004 | — |
| microsoft windows_server_2019 | No range specified | — |
| canonical ubuntu_linux | 14.04, 16.04, 18.04, 20.04 | — |
| debian debian_linux | 10.0 | — |
| opensuse leap | 15.1, 15.2 | — |
| suse suse_linux_enterprise_server | 11, 12, 15 | — |
| netapp active_iq_unified_manager | 9.5 ≤ v | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.