CVE-2020-15707

moderate-risk
Published 2020-07-29

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.7/10 Medium
LOCAL / HIGH complexity

Affected Products (20)

Affected Vendors

Debian Redhat Microsoft Gnu Suse Canonical Netapp Opensuse

References (34)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html
Third Party Advisory http://ubuntu.com/security/notices/USN-4432-1
Mailing List http://www.openwall.com/lists/oss-security/2020/07/29/3
Third Party Advisory https://access.redhat.com/security/vulnerabilities/grub2bootloader
Issue Tracking https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011
Third Party Advisory https://security.gentoo.org/glsa/202104-05
Third Party Advisory https://security.netapp.com/advisory/ntap-20200731-0008/
Third Party Advisory https://usn.ubuntu.com/4432-1/
Third Party Advisory https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
Third Party Advisory https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot
Third Party Advisory https://www.debian.org/security/2020/dsa-4735
Exploit https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
Mailing List https://www.openwall.com/lists/oss-security/2020/07/29/3
Third Party Advisory https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/
Third Party Advisory https://www.suse.com/support/kb/doc/?id=000019673
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html
Third Party Advisory http://ubuntu.com/security/notices/USN-4432-1
and 14 more references
38
/ 100
moderate-risk
Severity 15/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 23/34 · High