Red Hat AUS 7.2 update for grub2
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 7 |
| CVE-ID | CVE-2020-10713 CVE-2020-14308 CVE-2020-14309 CVE-2020-14310 CVE-2020-14311 CVE-2020-15705 CVE-2020-15706 |
| CWE-ID | CWE-787 CWE-122 CWE-190 CWE-347 CWE-362 |
| Exploitation vector | Local |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software |
shim-signed (Red Hat package) Operating systems & Components / Operating system package or component shim (Red Hat package) Operating systems & Components / Operating system package or component grub2 (Red Hat package) Operating systems & Components / Operating system package or component Red Hat Enterprise Linux Server - AUS Operating systems & Components / Operating system |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 7 vulnerabilities.
1) Out-of-bounds Write
EUVDB-ID: #VU32922
Risk: Low
CVSSv4.0: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2020-10713
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: Yes
Description
The vulnerability allows a local attacker to compromise vulnerable system.
The vulnerability exists due to a "BootHole" issue. An attacker with physical access can install persistent and stealthy bootkits or malicious bootloaders, trigger out-of-bounds write and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
shim-signed (Red Hat package): 15-7.el7_8
shim (Red Hat package): 15-7.el7_9
Red Hat Enterprise Linux Server - AUS: 7.2
grub2 (Red Hat package): 2.02-0.33.el7_2
CPE2.3- cpe:2.3:o:red_hat:shim-signed_redhat_package:15-7.el7_8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:shim_redhat_package:15-7.el7_9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:7.2:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:grub2_redhat_package:2.02-0.33.el7_2:*:*:*:*:red_hat_enterprise_linux:*:*
http://access.redhat.com/errata/RHSA-2020:3273
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Heap-based buffer overflow
EUVDB-ID: #VU32923
Risk: Low
CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2020-14308
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. An attacker with physical access can trigger heap-based buffer overflow and execute arbitrary code on the target system during the boot process.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
shim-signed (Red Hat package): 15-7.el7_8
shim (Red Hat package): 15-7.el7_9
Red Hat Enterprise Linux Server - AUS: 7.2
grub2 (Red Hat package): 2.02-0.33.el7_2
CPE2.3- cpe:2.3:o:red_hat:shim-signed_redhat_package:15-7.el7_8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:shim_redhat_package:15-7.el7_9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:7.2:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:grub2_redhat_package:2.02-0.33.el7_2:*:*:*:*:red_hat_enterprise_linux:*:*
http://access.redhat.com/errata/RHSA-2020:3273
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Integer overflow
EUVDB-ID: #VU32934
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2020-14309
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow when handling symlinks on ext filesustem in grub_squash_read_symlink() function. A local user can create a specially crafted symlink, trigger an integer overflow and crash the system.
Install updates from vendor's website.
shim-signed (Red Hat package): 15-7.el7_8
shim (Red Hat package): 15-7.el7_9
Red Hat Enterprise Linux Server - AUS: 7.2
grub2 (Red Hat package): 2.02-0.33.el7_2
CPE2.3- cpe:2.3:o:red_hat:shim-signed_redhat_package:15-7.el7_8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:shim_redhat_package:15-7.el7_9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:7.2:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:grub2_redhat_package:2.02-0.33.el7_2:*:*:*:*:red_hat_enterprise_linux:*:*
http://access.redhat.com/errata/RHSA-2020:3273
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Integer overflow
EUVDB-ID: #VU32935
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2020-14310
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the read_section_as_string() function when processing font names. A local user can create a specially crafted font name, trigger integer overflow and crash the affected system.
Install updates from vendor's website.
shim-signed (Red Hat package): 15-7.el7_8
shim (Red Hat package): 15-7.el7_9
Red Hat Enterprise Linux Server - AUS: 7.2
grub2 (Red Hat package): 2.02-0.33.el7_2
CPE2.3- cpe:2.3:o:red_hat:shim-signed_redhat_package:15-7.el7_8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:shim_redhat_package:15-7.el7_9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:7.2:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:grub2_redhat_package:2.02-0.33.el7_2:*:*:*:*:red_hat_enterprise_linux:*:*
http://access.redhat.com/errata/RHSA-2020:3273
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Integer overflow
EUVDB-ID: #VU32936
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2020-14311
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the grub_ext2_read_link() function when processing symlinks. A local user can create a specially crafted symlink, trigger integer overflow and crash the system.
Install updates from vendor's website.
shim-signed (Red Hat package): 15-7.el7_8
shim (Red Hat package): 15-7.el7_9
Red Hat Enterprise Linux Server - AUS: 7.2
grub2 (Red Hat package): 2.02-0.33.el7_2
CPE2.3- cpe:2.3:o:red_hat:shim-signed_redhat_package:15-7.el7_8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:shim_redhat_package:15-7.el7_9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:7.2:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:grub2_redhat_package:2.02-0.33.el7_2:*:*:*:*:red_hat_enterprise_linux:*:*
http://access.redhat.com/errata/RHSA-2020:3273
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Improper Verification of Cryptographic Signature
EUVDB-ID: #VU32927
Risk: Low
CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2020-15705
CWE-ID:
CWE-347 - Improper Verification of Cryptographic Signature
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to compromise the target system.
The vulnerability exists due to the affected software fails to validate kernel signature when booted directly without shim. An attacker with physical access can bypass secure boot.
MitigationInstall updates from vendor's website.
shim-signed (Red Hat package): 15-7.el7_8
shim (Red Hat package): 15-7.el7_9
Red Hat Enterprise Linux Server - AUS: 7.2
grub2 (Red Hat package): 2.02-0.33.el7_2
CPE2.3- cpe:2.3:o:red_hat:shim-signed_redhat_package:15-7.el7_8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:shim_redhat_package:15-7.el7_9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:7.2:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:grub2_redhat_package:2.02-0.33.el7_2:*:*:*:*:red_hat_enterprise_linux:*:*
http://access.redhat.com/errata/RHSA-2020:3273
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Race condition
EUVDB-ID: #VU32926
Risk: Low
CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2020-15706
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to execute arbitrary code and bypass secure boot restriction.
The vulnerability exists due to a race condition in the "grub_script_function_create()" function. An attacker with physical access can exploit the race and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
shim-signed (Red Hat package): 15-7.el7_8
shim (Red Hat package): 15-7.el7_9
Red Hat Enterprise Linux Server - AUS: 7.2
grub2 (Red Hat package): 2.02-0.33.el7_2
CPE2.3- cpe:2.3:o:red_hat:shim-signed_redhat_package:15-7.el7_8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:shim_redhat_package:15-7.el7_9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:7.2:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:grub2_redhat_package:2.02-0.33.el7_2:*:*:*:*:red_hat_enterprise_linux:*:*
http://access.redhat.com/errata/RHSA-2020:3273
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
