Gnu · Grub2 · CVE-2015-8370
**Name of the Vulnerable Software and Affected Versions**
Grub2 versions 1.98 through 2.02
**Description**
The issue is caused by multiple integer underflows that allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption). This can be achieved via backspace characters in the `grub username get` function in grub-core/normal/auth.c or the `grub password get` function in lib/crypto.c, triggering an "Off-by-two" or "Out of bounds overwrite" memory error.
**Recommendations**
For Grub2 versions 1.98 through 2.02, as a temporary workaround, consider disabling the `grub username get` and `grub password get` functions until a patch is available. Restrict access to the grub-core/normal/auth.c and lib/crypto.c modules to minimize the risk of exploitation. Avoid using backspace characters in the affected functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.