CVE-2015-8370: Integer Underflow
Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grubusernameget function in grub-core/normal/auth.c or the (2) grubpasswordget function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8370?
CVE-2015-8370 is considered a high severity vulnerability due to its potential to bypass authentication and cause denial of service.
How do I fix CVE-2015-8370?
To fix CVE-2015-8370, upgrade Grub2 to version 2.02 or later, which includes patches that address this vulnerability.
What types of attacks does CVE-2015-8370 allow?
CVE-2015-8370 may allow attackers to bypass authentication, access sensitive information, or cause disk corruption.
Which software versions are affected by CVE-2015-8370?
CVE-2015-8370 affects Grub2 versions 1.98 through 2.02, as well as Fedora version 23.
Who can exploit CVE-2015-8370?
CVE-2015-8370 can be exploited by physically proximate attackers who have access to the system.