Buffer overflow in GNU Grub2
CVE-2020-10713
A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.017 (77.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 77.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: 0.000
Affected products
- GNU Grub2
- VMware Photon OS
- Debian Linux — versions 10.0
- openSUSE Leap — versions 15.1, 15.2
- Grub — versions All grub2 versions before 2.06
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.debian.org/security/2020/dsa-4735 (vendor-advisory, Third Party Advisory)
- www.openwall.com/lists/oss-security/2020/07/29/3 (mailing-list, Mailing List, Third Party Advisory)
- bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)
- www.kb.cert.org/vuls/id/174059 (US Government Resource, Third Party Advisory, third-party-advisory)
- security.netapp.com/advisory/ntap-20200731-0008/ (Third Party Advisory)
- usn.ubuntu.com/4432-1/ (vendor-advisory, Third Party Advisory)
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-grub2-co… (vendor-advisory, Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html (vendor-advisory, Mailing List, Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html (vendor-advisory, Mailing List, Third Party Advisory)
- eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/ (Technical Description, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-10713?
- CVE-2020-10713 is a high-severity vulnerability in GNU Grub2, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 8.2/10. Published 2020-07-30.
- How severe is CVE-2020-10713?
- High severity. CVSS v3 base score is 8.2 out of 10.
- Is CVE-2020-10713 known to be exploited?
- 56 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.