Vulnerability Description
In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Grub2 | < 2.06 |
| Opensuse | Leap | 15.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.htmlMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2020/07/29/3Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/09/17/2Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/09/17/4Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/09/21/1Mailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1852009Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202104-05Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200731-0008/Third Party Advisory
- https://usn.ubuntu.com/4432-1/Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.htmlMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2020/07/29/3Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/09/17/2Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/09/17/4Mailing ListThird Party Advisory
FAQ
What is CVE-2020-14308?
CVE-2020-14308 is a vulnerability with a CVSS score of 6.4 (MEDIUM). In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations w...
How severe is CVE-2020-14308?
CVE-2020-14308 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-14308?
Check the references section above for vendor advisories and patch information. Affected products include: Gnu Grub2, Opensuse Leap.