PT-2015-2740 · Red Hat+1 · Grub2+2
Stefan Cornelius
·
Published
2015-11-19
·
Updated
2016-12-07
·
CVE-2015-5281
CVSS v2.0
2.6
Low
| Vector | AV:L/AC:H/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7
Description
The issue allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted multiboot or multiboot2 module in the configuration file. Physically proximate attackers can also bypass intended Secure Boot restrictions and execute non-verified code via the boot menu. The vulnerability is related to insufficient access control to files.
Recommendations
For grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, update to a version 2.02-0.29 or later to resolve the issue. As a temporary workaround, consider restricting access to the configuration file and the boot menu to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Red Hat
Grub2