CVE-2020-15705

Sažetak

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.

Reference

https://www.suse.com/support/kb/doc/?id=000019673
http://ubuntu.com/security/notices/USN-4432-1
https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011
https://access.redhat.com/security/vulnerabilities/grub2bootloader
https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/
https://www.openwall.com/lists/oss-security/2020/07/29/3
http://www.openwall.com/lists/oss-security/2020/07/29/3
https://security.netapp.com/advisory/ntap-20200731-0008/
https://usn.ubuntu.com/4432-1/
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00067.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00069.html
http://www.openwall.com/lists/oss-security/2021/03/02/3
https://security.gentoo.org/glsa/202104-05
http://www.openwall.com/lists/oss-security/2021/09/17/2
http://www.openwall.com/lists/oss-security/2021/09/17/4
http://www.openwall.com/lists/oss-security/2021/09/21/1

CVSS

Base:	4.4
Impact:	6.4
Exploitability:	3.4

Pristup

Vektor	Složenost	Autentikacija
LOCAL	MEDIUM	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	PARTIAL	PARTIAL

CVSS vektor

AV:L/AC:M/Au:N/C:P/I:P/A:P

Zadnje važnije ažuriranje

18-04-2022 - 15:22

Objavljeno

29-07-2020 - 18:15