CVE-2015-5281

Published: 24 November 2015

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.

Notes

Author	Note
mdeslaur	RHEL specific issue

Priority

Status

Package	Release	Status
grub2 Launchpad, Ubuntu, Debian	precise	Ignored (end of life)
	trusty	Not vulnerable
	upstream	Needs triage
	vivid	Ignored (end of life)
	wily	Ignored (end of life)
	xenial	Not vulnerable
	yakkety	Ignored (end of life)
	zesty	Not vulnerable

References

Bugs

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5281

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›