CVE-2020-14309

MEDIUM

GRUB2 < 2.06 - Heap-Based Buffer Overflow via SquashFS Symbolic Link Name

Title source: llm
STIX 2.1

Description

There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data.

References (6)

Core 6
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1852022
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20200731-0008/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4432-1/
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202104-05

Scores

CVSS v3 6.7
EPSS 0.0004
EPSS Percentile 13.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-190 CWE-787
Status published
Products (3)
gnu/grub2 < 2.06
opensuse/leap 15.1
opensuse/leap 15.2
Published Jul 30, 2020
Tracked Since Feb 18, 2026