Summary
[2.02-81.0.4]
- Fix CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311,
CVE-2020-15705, CVE-2020-15706, CVE-2020-15707 [Orabug: 31225072]
- Update signing certificate for efi binaries
[2.02-0.81.0.2]
- Enable common subpackage build for aarch64
- Disable RHEL patch 0183-efinet-retransmit-if-our-device-is-busy.patch to comply with UEFI spec
- increase timeout to 10ms in efinet.c, [Orabug: 27982684]
[2.02-0.81.0.1]
- Update upstream references [Orabug: 30138841]
- build with the updated Oracle certificate
- Restore symlink to grub environment file, that was removed during grub2-efi update
if grub2 package is also installed on UEFI machines [Orabug: 27345750]
- fix symlink removal scriptlet, to be executed only on removal [Orabug: 19231481]
- Pack files in efidir with disabled rpm verification [Orabug: 27166026]
- Fix comparison in patch for [Orabug: 18504756]
- Remove symlink to grub environment file during uninstall on EFI platforms [Orabug: 19231481]
- replace dynamic EFI boot folder path generation with predefined 'redhat' (Alex Burmashev)
- update Oracle Linux certificates (Alexey Petrenko)
- Put 'with' in menuentry instead of 'using' [Orabug: 18504756]
- Use different titles for UEK and RHCK kernels [Orabug: 18504756]
- changed efidir with 0700 access rights, redhat chose another approach in rhbz#1496952, [Orabug: 28622344]
- revert orabug [Orabug: 27166026] changes
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | grub2 | 1:2.02-0.81.0.4.el7 |
| Oracle Linux · 7 | grub2-efi-aa64 | 1:2.02-0.81.0.4.el7 |
| Oracle Linux · 7 | grub2-efi-aa64-cdboot | 1:2.02-0.81.0.4.el7 |
| Oracle Linux · 7 | grub2-tools | 1:2.02-0.81.0.4.el7 |
| Oracle Linux · 7 | grub2-tools-extra | 1:2.02-0.81.0.4.el7 |
| Oracle Linux · 7 | grub2-tools-minimal | 1:2.02-0.81.0.4.el7 |
Vulnerabilities 8
-
Medium 6.4
GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim
GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is boot…
-
Medium 6.4
GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.
GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restr…
-
Medium 5.7
There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at ma…
-
Medium 5.7
There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a s…
-
Medium 5.7
GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflo…
-
Unscored —CVE-2020-10713 Public exploit
A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB ver…
-
Unscored —
In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requeste…
-
Unscored —
There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link w…