CVE-2020-15707

Published Jul 29, 2020

Last updated 3 months ago

Overview

Description
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.
Source
security@ubuntu.com
NVD status
Modified

Risk scores

CVSS 3.1

Type
Primary
Base score
6.4
Impact score
5.9
Exploitability score
0.5
Vector string
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
4.4
Impact score
6.4
Exploitability score
3.4
Vector string
AV:L/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

security@ubuntu.com
CWE-362
nvd@nist.gov
CWE-190

Social media

Hype score
Not currently trending

Configurations

References