PT-2020-6593 · Grub2+8 · Grub2+8
Published
2020-10-09
·
Updated
2024-06-15
·
CVE-2020-25647
CVSS v3.1
7.6
High
| Vector | AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
grub2 versions prior to 2.06
Description
A flaw was found in grub2 during USB device initialization, where descriptors are read with very little bounds checking, assuming the USB device provides sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution, allowing a bypass of the Secure Boot mechanism. The highest threat from this issue is to data confidentiality and integrity as well as system availability.
Recommendations
For versions prior to 2.06, update to version 2.06 or later to resolve the issue. As a temporary workaround, consider restricting access to USB devices during the boot process to minimize the risk of exploitation.
Exploit
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Red Hat
Red Os
Rocky Linux
Suse
Grub2