CVE-2020-15707

Published: Jul 29, 2020Modified: Jun 17, 2026

6.4

Vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.5 / Impact: 5.9

Source: NVD

Description

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.

Affected (33)

Products: Gnu: Grub2 · Redhat: Enterprise Linux, Enterprise Linux Atomic Host, Openshift Container Platform · Microsoft: Windows 10, Windows 8.1, Windows Rt 8.1, Windows Server 2012, Windows Server 2016, Windows Server 2019 · +5 more

Show all products

1 product

3 products

Enterprise Linux Atomic Host

Openshift Container Platform

6 products

1 product

1 product

1 product

1 product

Suse Linux Enterprise Server

Netapp

1 product

Active Iq Unified Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Grub2	Up to 2.04

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Atomic Host	All versions
Redhat Openshift Container Platform	Version 4.0

Configuration C

17 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 10	All versions
Microsoft Windows 10	Version 1607
Microsoft Windows 10	Version 1709
Microsoft Windows 10	Version 1803
Microsoft Windows 10	Version 1809
Microsoft Windows 10	Version 1903
Microsoft Windows 10	Version 1909
Microsoft Windows 10	Version 2004
Microsoft Windows 8.1	All versions
Microsoft Windows Rt 8.1	All versions
Microsoft Windows Server 2012	All versions
Microsoft Windows Server 2012	Version r2
Microsoft Windows Server 2016	All versions
Microsoft Windows Server 2016	Version 1903
Microsoft Windows Server 2016	Version 1909
Microsoft Windows Server 2016	Version 2004
Microsoft Windows Server 2019	All versions

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 20.04

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Configuration F

5 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2
Suse Suse Linux Enterprise Server	Version 11
Suse Suse Linux Enterprise Server	Version 12
Suse Suse Linux Enterprise Server	Version 15

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	From 9.5

Related CWEs

CWE-190

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (34)

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html

Source: security@ubuntu.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html

Source: security@ubuntu.com

Mailing ListThird Party Advisory

http://ubuntu.com/security/notices/USN-4432-1

Source: security@ubuntu.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2020/07/29/3

Source: security@ubuntu.com

Mailing ListThird Party Advisory

https://access.redhat.com/security/vulnerabilities/grub2bootloader

Source: security@ubuntu.com

Third Party Advisory

https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html

Source: security@ubuntu.com

Issue TrackingVendor Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011

Source: security@ubuntu.com

PatchThird Party AdvisoryVendor Advisory

https://security.gentoo.org/glsa/202104-05

Source: security@ubuntu.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200731-0008/

Source: security@ubuntu.com

Third Party Advisory

https://usn.ubuntu.com/4432-1/

Source: security@ubuntu.com

Third Party Advisory

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass

Source: security@ubuntu.com

Third Party Advisory

https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot

Source: security@ubuntu.com

Third Party Advisory

https://www.debian.org/security/2020/dsa-4735

Source: security@ubuntu.com

Third Party Advisory

https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/

Source: security@ubuntu.com

ExploitThird Party Advisory

https://www.openwall.com/lists/oss-security/2020/07/29/3

Source: security@ubuntu.com

Mailing ListThird Party Advisory

https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/

Source: security@ubuntu.com

Third Party Advisory

https://www.suse.com/support/kb/doc/?id=000019673

Source: security@ubuntu.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html