Red Hat Security Advisory: grub2 security and bug fix update

Fixed packages 126

Vulnerabilities 8

• Medium 6.4
  CVE-2020-15705

  GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim

  GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is boot…

  Ubuntu grub2 in Ubuntu grub2-signed grub2-unsigned Ubuntu Alpine
  Jul 29, 2020
• Medium 6.4
  CVE-2020-15706

  GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.

  GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restr…

  Ubuntu grub2 in Ubuntu grub2 grub2-signed Debian Ubuntu Alpine
  Jul 29, 2020
• Medium 5.7
  CVE-2020-14310

  There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at ma…

  The Grub2 Project grub2 grub2 grub2-signed Debian Ubuntu Azure Linux Alpine
  Jul 31, 2020
• Medium 5.7
  CVE-2020-14311

  There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a s…

  The Grub2 Project grub2 grub2 grub2-signed Debian Ubuntu Azure Linux Alpine
  Jul 31, 2020
• Medium 5.7
  CVE-2020-15707

  GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.

  Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflo…

  Ubuntu grub2 in Ubuntu grub2 grub2-signed Debian Ubuntu Alpine
  Jul 29, 2020
• Unscored —
  CVE-2020-10713 Public exploit

  A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB ver…

  grub2 grub2-signed grub2-unsigned grub2 Debian Ubuntu Azure Linux Alpine
  Jul 30, 2020
• Unscored —
  CVE-2020-14308

  In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requeste…

  grub2 grub2-signed grub2-unsigned grub2 Debian Ubuntu Azure Linux Alpine
  Jul 29, 2020
• Unscored —
  CVE-2020-14309

  There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link w…

  grub2 grub2-signed grub2-unsigned grub2 Debian Ubuntu Azure Linux Alpine
  Jul 30, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/security/vulnerabilities/grub2bootloader
• article
  https://access.redhat.com/errata/RHBA-2020:3265
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1616395
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1732765
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1825243
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1852009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1852014
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1852022
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1852030
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1860978
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1861118
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1861581
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3217.json
• report
  https://access.redhat.com/security/cve/CVE-2020-10713
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-10713
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-10713
• article
  https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
• article
  https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
• article
  https://www.openwall.com/lists/oss-security/2020/07/29/3
• report
  https://access.redhat.com/security/cve/CVE-2020-14308
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-14308
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-14308
• report
  https://access.redhat.com/security/cve/CVE-2020-14309
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-14309
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-14309
• report
  https://access.redhat.com/security/cve/CVE-2020-14310
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-14310
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-14310
• report
  https://access.redhat.com/security/cve/CVE-2020-14311
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-14311
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-14311
• report
  https://access.redhat.com/security/cve/CVE-2020-15705
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15705
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15705
• report
  https://access.redhat.com/security/cve/CVE-2020-15706
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15706
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15706
• report
  https://access.redhat.com/security/cve/CVE-2020-15707