Vulnerability Description
GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Grub2 | <= 2.04 |
| Redhat | Enterprise Linux Atomic Host | - |
| Redhat | Openshift Container Platform | 4.0 |
| Canonical | Ubuntu Linux | 14.04 |
| Debian | Debian Linux | 10.0 |
| Redhat | Enterprise Linux | 7.0 |
| Suse | Suse Linux Enterprise Server | 11 |
| Microsoft | Windows 10 | - |
| Microsoft | Windows 8.1 | - |
| Microsoft | Windows Rt 8.1 | - |
| Microsoft | Windows Server 2012 | - |
| Microsoft | Windows Server 2016 | - |
| Microsoft | Windows Server 2019 | - |
| Opensuse | Leap | 15.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.htmlBroken LinkMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.htmlBroken LinkMailing ListThird Party Advisory
- http://ubuntu.com/security/notices/USN-4432-1Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/07/29/3Mailing ListThird Party Advisory
- https://access.redhat.com/security/vulnerabilities/grub2bootloaderThird Party Advisory
- https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.htmlIssue TrackingVendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011PatchThird Party AdvisoryVendor Advisory
- https://security.gentoo.org/glsa/202104-05Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200731-0008/Third Party Advisory
- https://usn.ubuntu.com/4432-1/Third Party Advisory
- https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypassThird Party Advisory
- https://www.debian.org/security/2020-GRUB-UEFI-SecureBootThird Party Advisory
- https://www.debian.org/security/2020/dsa-4735Third Party Advisory
- https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/Third Party Advisory
- https://www.openwall.com/lists/oss-security/2020/07/29/3Mailing ListThird Party Advisory
FAQ
What is CVE-2020-15706?
CVE-2020-15706 is a vulnerability with a CVSS score of 6.4 (MEDIUM). GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing...
How severe is CVE-2020-15706?
CVE-2020-15706 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15706?
Check the references section above for vendor advisories and patch information. Affected products include: Gnu Grub2, Redhat Enterprise Linux Atomic Host, Redhat Openshift Container Platform, Canonical Ubuntu Linux, Debian Debian Linux.