CVE-2020-15706
Published: 29 July 2020
GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.
From the Ubuntu security team
Chris Coulson discovered that the GRUB2 function handling code did not properly handle a function being redefined, leading to a use-after-free vulnerability. A local attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions.
Priority
High
CVSS 3 base score: 6.4
Status
| Package | Release | Status |
|---|---|---|
|
grub2 Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 21.04 (Hirsute Hippo) |
Not vulnerable
(2.04-1ubuntu26.1)
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Released
(2.04-1ubuntu26.1)
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Released
(2.02-2ubuntu8.16)
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Released
(2.02~beta2-36ubuntu3.26)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Released
(2.02~beta2-9ubuntu1.20)
|
|
|
grub2-signed Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 21.04 (Hirsute Hippo) |
Not vulnerable
(1.147)
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Released
(1.142.3)
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Released
(1.93.18)
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Released
(1.66.26)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Released
(1.34.22)
|
Notes
| Author | Note |
|---|---|
| amurray | grub2-signed is not supported in Ubuntu 12.04 ESM (precise/esm) and so marking the priority for grub2 in this release as low |
| sbeattie | 809f3a268 script: Avoid a use-after-free when redefining a function during execution |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15706
- https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
- https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
- https://www.openwall.com/lists/oss-security/2020/07/29/3
- https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
- https://ubuntu.com/security/notices/USN-4432-1
- NVD
- Launchpad
- Debian