CVE-2020-15706
29.07.2020, 18:15
GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.
| Vendor | Product | Version |
|---|---|---|
| gnu | grub2 | 𝑥 ≤ 2.04 |
| redhat | enterprise_linux_atomic_host | - |
| redhat | openshift_container_platform | 4.0 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 20.04 |
| debian | debian_linux | 10.0 |
| redhat | enterprise_linux | 7.0 |
| redhat | enterprise_linux | 8.0 |
| microsoft | windows_10 | - |
| microsoft | windows_8.1 | - |
| microsoft | windows_rt_8.1 | - |
| microsoft | windows_server_2012 | - |
| microsoft | windows_server_2016 | - |
| microsoft | windows_server_2019 | - |
| opensuse | leap | 15.1 |
| opensuse | leap | 15.2 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 20.04 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| grub2 |
| ||||||||||||||||||||||
| grub2-signed |
| ||||||||||||||||||||||
| grub2-unsigned |
|
References