Summary
Jesse Michael and Mickey Shkatov discovered that the configuration parser
in GRUB2 did not properly exit when errors were discovered, resulting in
heap-based buffer overflows. A local attacker could use this to execute
arbitrary code and bypass UEFI Secure Boot restrictions. (CVE-2020-10713)
Chris Coulson discovered that the GRUB2 function handling code did not
properly handle a function being redefined, leading to a use-after-free
vulnerability. A local attacker could use this to execute arbitrary code
and bypass UEFI Secure Boot restrictions. (CVE-2020-15706)
Chris Coulson discovered that multiple integer overflows existed in GRUB2
when handling certain filesystems or font files, leading to heap-based
buffer overflows. A local attacker could use these to execute arbitrary
code and bypass UEFI Secure Boot restrictions. (CVE-2020-14309,
CVE-2020-14310, CVE-2020-14311)
It was discovered that the memory allocator for GRUB2 did not validate
allocation size, resulting in multiple integer overflows and heap-based
buffer overflows when handling certain filesystems, PNG images or disk
metadata. A local attacker could use this to execute arbitrary code and
bypass UEFI Secure Boot restrictions. (CVE-2020-14308)
Mathieu Trudel-Lapierre discovered that in certain situations, GRUB2
failed to validate kernel signatures. A local attacker could use this
to bypass Secure Boot restrictions. (CVE-2020-15705)
Colin Watson and Chris Coulson discovered that an integer overflow
existed in GRUB2 when handling the initrd command, leading to a heap-based
buffer overflow. A local attacker could use this to execute arbitrary code
and bypass UEFI Secure Boot restrictions. (CVE-2020-15707)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | grub2 | 2.02~beta2-36ubuntu3.26 |
| Ubuntu · 16.04 LTS 16.04:LTS | grub2-signed | 1.66.26 |
| Ubuntu · 18.04 LTS 18.04:LTS | grub2 | 2.02-2ubuntu8.16 |
| Ubuntu · 18.04 LTS 18.04:LTS | grub2-signed | 1.93.18 |
| Ubuntu · 20.04 LTS 20.04:LTS | grub2 | 2.04-1ubuntu26.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | grub2-signed | 1.142.3 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | grub2 | 2.02~beta2-9ubuntu1.20 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | grub2-signed | 1.34.22 |
Vulnerabilities 8
-
Medium 6.4
GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim
GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is boot…
-
Medium 6.4
GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.
GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restr…
-
Medium 5.7
There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at ma…
-
Medium 5.7
There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a s…
-
Medium 5.7
GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflo…
-
Unscored —CVE-2020-10713 Public exploit
A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB ver…
-
Unscored —
In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requeste…
-
Unscored —
There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link w…
References
-
report
https://ubuntu.com/security/CVE-2020-10713
-
report
https://ubuntu.com/security/CVE-2020-14308
-
report
https://ubuntu.com/security/CVE-2020-14309
-
report
https://ubuntu.com/security/CVE-2020-14310
-
report
https://ubuntu.com/security/CVE-2020-14311
-
report
https://ubuntu.com/security/CVE-2020-15705
-
report
https://ubuntu.com/security/CVE-2020-15706
-
report
https://ubuntu.com/security/CVE-2020-15707