CVE-2020-15706
Published: 29 July 2020
GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.
From the Ubuntu Security Team
Chris Coulson discovered that the GRUB2 function handling code did not properly handle a function being redefined, leading to a use-after-free vulnerability. A local attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions.
Notes
| Author | Note |
|---|---|
| alexmurray | grub2-signed is not supported in Ubuntu 12.04 ESM (precise/esm) and so marking the priority for grub2 in this release as low |
| sbeattie | 809f3a268 script: Avoid a use-after-free when redefining a function during execution |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
grub2 Launchpad, Ubuntu, Debian |
jammy |
Not vulnerable
(2.06-2ubuntu7)
|
| kinetic |
Not vulnerable
(2.06-2ubuntu12)
|
|
| lunar |
Not vulnerable
(2.06-2ubuntu16)
|
|
| hirsute |
Not vulnerable
(2.04-1ubuntu26.1)
|
|
| bionic |
Released
(2.02-2ubuntu8.16)
|
|
| focal |
Released
(2.04-1ubuntu26.1)
|
|
| groovy |
Not vulnerable
(2.04-1ubuntu26.1)
|
|
| trusty |
Released
(2.02~beta2-9ubuntu1.20)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Needs triage
|
|
| xenial |
Released
(2.02~beta2-36ubuntu3.26)
|
|
| mantic |
Not vulnerable
(2.06-2ubuntu18)
|
|
|
grub2-signed Launchpad, Ubuntu, Debian |
jammy |
Not vulnerable
(1.180)
|
| kinetic |
Not vulnerable
(1.185)
|
|
| lunar |
Not vulnerable
(1.192)
|
|
| hirsute |
Not vulnerable
(1.147)
|
|
| bionic |
Released
(1.93.18)
|
|
| focal |
Released
(1.142.3)
|
|
| groovy |
Not vulnerable
(1.147)
|
|
| trusty |
Released
(1.34.22)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Needs triage
|
|
| xenial |
Released
(1.66.26)
|
|
| mantic |
Not vulnerable
(1.193)
|
|
|
grub2-unsigned Launchpad, Ubuntu, Debian |
trusty |
Does not exist
|
| xenial |
Needed
|
|
| bionic |
Not vulnerable
(2.04-1ubuntu47.4)
|
|
| focal |
Not vulnerable
(2.04-1ubuntu47.4)
|
|
| jammy |
Not vulnerable
(2.06-2ubuntu10)
|
|
| kinetic |
Not vulnerable
(2.06-2ubuntu12)
|
|
| lunar |
Not vulnerable
(2.06-2ubuntu16)
|
|
| upstream |
Needs triage
|
|
| mantic |
Not vulnerable
(2.06-2ubuntu17)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.4 |
| Attack vector | Local |
| Attack complexity | High |
| Privileges required | High |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15706
- https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
- https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
- https://www.openwall.com/lists/oss-security/2020/07/29/3
- https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
- https://ubuntu.com/security/notices/USN-4432-1
- NVD
- Launchpad
- Debian