#VU97100 Privilege Defined With Unsafe Actions in grub - CVE-2019-14865
Published: September 10, 2024
Vulnerability identifier: #VU97100
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-14865
CWE-ID: CWE-267
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
grub
grub
Software vendor:
GNU
GNU
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to an error in the grub2-set-bootflag utility. A local user can run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots.
Remediation
Install updates from vendor's website.