Summary
[2.02-82.0.2.el8_2.1]
- Fix CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311,
CVE-2020-15705, CVE-2020-15706, CVE-2020-15707 [Orabug: 31225072]
- Update signing certificate for efi binaries
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | grub2-common | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-efi-aa64 | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-efi-aa64-cdboot | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-efi-aa64-modules | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-efi-ia32 | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-efi-ia32-cdboot | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-efi-ia32-modules | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-efi-x64 | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-efi-x64-cdboot | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-efi-x64-modules | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-pc | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-pc-modules | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-tools | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-tools-efi | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-tools-extra | 1:2.02-82.0.2.el8_2.1 |
| Oracle Linux · 8 | grub2-tools-minimal | 1:2.02-82.0.2.el8_2.1 |
Vulnerabilities 8
-
Medium 6.4
GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim
GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is boot…
-
Medium 6.4
GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.
GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restr…
-
Medium 5.7
There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at ma…
-
Medium 5.7
There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a s…
-
Medium 5.7
GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflo…
-
Unscored —CVE-2020-10713 Public exploit
A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB ver…
-
Unscored —
In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requeste…
-
Unscored —
There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link w…