Privilege Defined With Unsafe Actions in grub - CVE-2019-14865
Published: September 10, 2024
Vulnerability identifier: #VU97100
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-14865
CWE-ID: CWE-267
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: GNU
Affected software:
grub
grub
Detailed vulnerability description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to an error in the grub2-set-bootflag utility. A local user can run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots.
How to mitigate CVE-2019-14865
Install updates from vendor's website.