ID:5468 - Exploit for Security restrictions bypass in grub - CVE-2020-14372

Link to public exploit:

Vulnerability description

The vulnerability allows a local privileged user to bypass implemented security restrictions.

The vulnerability exists due to GRUB enables usage of the acpi command even when Secure Boot is enabled by firmware. A local user with root privileges can put a small SSDT into /boot/efi folder and modify the grub.cfg file to load that SSDT during kernel boot. The SSDT then gets run by the kernel and it overwrites the kernel lock down configuration enabling the attacker to load unsigned kernel modules and kexec unsigned code.

Remediation