Multiple vulnerabilities in GRUB2



Published: 2021-03-03 | Updated: 2022-10-19
Risk Low
Patch available YES
Number of vulnerabilities 8
CVE-ID CVE-2020-14372
CVE-2020-25632
CVE-2020-25647
CVE-2020-27749
CVE-2020-27779
CVE-2021-3418
CVE-2021-20225
CVE-2021-20233
CWE-ID CWE-264
CWE-416
CWE-787
CWE-121
CWE-285
CWE-281
Exploitation vector Local
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #8 is available.
Vulnerable software
Subscribe
grub
Universal components / Libraries / Libraries used by multiple products

Vendor GNU

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Security restrictions bypass

EUVDB-ID: #VU51187

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-14372

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

Description

The vulnerability allows a local privileged user to bypass implemented security restrictions.

The vulnerability exists due to GRUB enables usage of the acpi command even when Secure Boot is enabled by firmware. A local user with root privileges can put a small SSDT into /boot/efi folder and modify the grub.cfg file to load that SSDT during kernel boot. The SSDT then gets run by the kernel and it overwrites the kernel lock down configuration enabling the attacker to load unsigned kernel modules and kexec unsigned code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

grub: 2.00 - 2.06

External links

http://seclists.org/oss-sec/2021/q1/189


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Use-after-free

EUVDB-ID: #VU51188

Risk: Low

CVSSv3.1: 6 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-25632

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

Description

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to a use-after-free error when handling module unloads. A local privileged user can unload a kernel module, trigger a use-after-free error and bypass Secure Boot protection mechanism.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

grub: 2.00 - 2.06

External links

http://seclists.org/oss-sec/2021/q1/189


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Out-of-bounds write

EUVDB-ID: #VU51189

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-25647

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing untrusted input from USB device in grub_usb_device_initialize(). An attacker with physical access to the system can trigger an out-of-bounds write error with a malicious USB drive, bypass Secure Boot protection and execute arbitrary code on the system with elevated privileges.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

grub: 2.00 - 2.06

External links

http://seclists.org/oss-sec/2021/q1/189


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Stack-based buffer overflow

EUVDB-ID: #VU51193

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-27749

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the grub_parser_split_cmdline() function while expanding variable names present in the supplied command line in to their corresponding variable contents. A local privileged user can run a specially crafted program to trigger the stack-based buffer overflow and bypass Secure Boot protection.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

grub: 2.00 - 2.06

External links

http://seclists.org/oss-sec/2021/q1/189


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper Authorization

EUVDB-ID: #VU51194

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-27779

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a local user to bypass authorization checks.

The vulnerability exists within the cutmem command, which does not honor the Secure Boot locking. A local privileged user can remove address ranges from memory creating an opportunity to circumvent Secure Boot protections after proper triage about grub's memory layout.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

grub: 2.00 - 2.06

External links

http://seclists.org/oss-sec/2021/q1/189


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper preservation of permissions

EUVDB-ID: #VU51196

Risk: Low

CVSSv3.1: 3.6 [CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3418

CWE-ID: CWE-281 - Improper preservation of permissions

Exploit availability: No

Description

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists doe to re-introduction of vulnerability #VU32927, fixed in GRUB 2.05. If certificates that signed GRUB2 are installed into db, GRUB2 can be booted directly. It will then boot any kernel without signature validation. The booted kernel will think it was booted in Secure Boot mode and will implement lock down, yet it could have been tampered.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

grub: 2.05 - 2.06

External links

http://seclists.org/oss-sec/2021/q1/189


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds write

EUVDB-ID: #VU51197

Risk: Low

CVSSv3.1: 5.6 [CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-20225

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the option parser. A local privileged user can write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

grub: 2.00 - 2.06

External links

http://seclists.org/oss-sec/2021/q1/189


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds write

EUVDB-ID: #VU51198

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2021-20233

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the setparam_prefix() function in menu rendering code. A local privileged user can run a specially crafted program to trigger out-of-bounds write and escalate privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

grub: 2.00 - 2.06

External links

http://seclists.org/oss-sec/2021/q1/189


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###