Multiple vulnerabilities in GRUB2



Published: 2020-07-30
Risk Low
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2020-15705
CVE-2020-15706
CVE-2020-15707
CWE-ID CWE-347
CWE-362
CWE-190
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe 		grub
Universal components / Libraries / Libraries used by multiple products

Vendor GNU

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU32927

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-15705

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

Description

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to the affected software fails to validate kernel signature when booted directly without shim. An attacker with physical access can bypass secure boot.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

grub: 1.99 - 2.04

External links

http://ubuntu.com/security/notices/USN-4432-1
http://www.openwall.com/lists/oss-security/2020/07/29/3
http://access.redhat.com/security/vulnerabilities/grub2bootloader
http://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011
http://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
http://www.debian.org/security/2020-GRUB-UEFI-SecureBoot
http://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
http://www.openwall.com/lists/oss-security/2020/07/29/3
http://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/
http://www.suse.com/support/kb/doc/?id=000019673


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Race condition

EUVDB-ID: #VU32926

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-15706

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local attacker to execute arbitrary code and bypass secure boot restriction.

The vulnerability exists due to a race condition in the "grub_script_function_create()" function. An attacker with physical access can exploit the race and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

grub: 1.99 - 2.04

External links

http://ubuntu.com/security/notices/USN-4432-1
http://www.openwall.com/lists/oss-security/2020/07/29/3
http://access.redhat.com/security/vulnerabilities/grub2bootloader
http://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011
http://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
http://www.debian.org/security/2020/dsa-4735
http://www.debian.org/security/2020-GRUB-UEFI-SecureBoot
http://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
http://www.openwall.com/lists/oss-security/2020/07/29/3
http://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/
http://www.suse.com/support/kb/doc/?id=000019673


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Integer overflow

EUVDB-ID: #VU32925

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-15707

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the "grub_cmd_initrd" and "grub_initrd_init" functions in the "efilinux" component. An attacker with physical access can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

grub: 1.99 - 2.04

External links

http://ubuntu.com/security/notices/USN-4432-1
http://www.openwall.com/lists/oss-security/2020/07/29/3
http://access.redhat.com/security/vulnerabilities/grub2bootloader
http://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011
http://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
http://www.debian.org/security/2020/dsa-4735
http://www.debian.org/security/2020-GRUB-UEFI-SecureBoot
http://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
http://www.openwall.com/lists/oss-security/2020/07/29/3
http://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/
http://www.suse.com/support/kb/doc/?id=000019673


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###