CVE-2020-15707

MEDIUM

GRUB2 < 2.04 - Integer Overflow and Heap-Based Buffer Overflow in efilinux initrd Handling

Title source: llm
STIX 2.1

Description

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.

References (17)

Core 17
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://ubuntu.com/security/notices/USN-4432-1
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot
Patch, Third Party Advisory, Vendor Advisory x_refsource_confirm
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/security/vulnerabilities/grub2bootloader
Third Party Advisory vendor-advisory x_refsource_suse
https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/
Third Party Advisory vendor-advisory x_refsource_suse
https://www.suse.com/support/kb/doc/?id=000019673
Mailing List, Third Party Advisory x_refsource_confirm
https://www.openwall.com/lists/oss-security/2020/07/29/3
Issue Tracking, Vendor Advisory x_refsource_confirm
https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2020/dsa-4735
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2020/07/29/3
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20200731-0008/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4432-1/
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202104-05

Scores

CVSS v3 5.7
EPSS 0.0003
EPSS Percentile 9.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H

Details

CWE
CWE-190 CWE-362
Status published
Products (33)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 20.04
debian/debian_linux 10.0
gnu/grub2 < 2.04
microsoft/windows_10
microsoft/windows_10 1607
microsoft/windows_10 1709
microsoft/windows_10 1803
... and 23 more
Published Jul 29, 2020
Tracked Since Feb 18, 2026