#VU51187 Security restrictions bypass in grub - CVE-2020-14372
Published: March 3, 2021 / Updated: December 17, 2024
Vulnerability identifier: #VU51187
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2020-14372
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerable software:
grub
grub
Software vendor:
GNU
GNU
Description
The vulnerability allows a local privileged user to bypass implemented security restrictions.
The vulnerability exists due to GRUB enables usage of the acpi command even when Secure Boot is enabled by firmware. A local user with root privileges can put a small SSDT into /boot/efi folder and modify the grub.cfg file to load that SSDT during kernel boot. The SSDT then gets run by the kernel and it overwrites the kernel lock down configuration enabling the attacker to load unsigned kernel modules and kexec unsigned code.
Remediation
Install updates from vendor's repository.