CVE-2020-15706

moderate-risk

Published 2020-07-29

GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.

Do I need to act?

0.05% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.4/10 Medium

LOCAL / HIGH complexity

Affected Products (20)

Grub2

Enterprise Linux Atomic Host

Openshift Container Platform

Ubuntu Linux

Debian Linux

Enterprise Linux

Suse Linux Enterprise Server

Windows 10

Affected Vendors

Debian Redhat Microsoft Gnu Suse Canonical Opensuse

References (34)

Broken Link http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html

Broken Link http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html

Third Party Advisory http://ubuntu.com/security/notices/USN-4432-1

Mailing List http://www.openwall.com/lists/oss-security/2020/07/29/3

Third Party Advisory https://access.redhat.com/security/vulnerabilities/grub2bootloader

Issue Tracking https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html

Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011

Third Party Advisory https://security.gentoo.org/glsa/202104-05

Third Party Advisory https://security.netapp.com/advisory/ntap-20200731-0008/

Third Party Advisory https://usn.ubuntu.com/4432-1/

Third Party Advisory https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass

Third Party Advisory https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot

Third Party Advisory https://www.debian.org/security/2020/dsa-4735

Third Party Advisory https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/

Mailing List https://www.openwall.com/lists/oss-security/2020/07/29/3

Third Party Advisory https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/

Third Party Advisory https://www.suse.com/support/kb/doc/?id=000019673

Broken Link http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html

Broken Link http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html

Third Party Advisory http://ubuntu.com/security/notices/USN-4432-1

and 14 more references

/ 100

moderate-risk

Severity 17/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 23/34 · High