CVE-2020-14308: Integer Overflow
A flaw was found in current grub2 versions as shipped with Red Hat Enterprise Linux 7 and 8, where the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This issue leads the function to return invalid memory allocations, causing heap-based overflows in several code paths. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.
Other sources
Currently grubmalloc() function and related memory infrastructure underlying it doesn't fully validate the allocation size. This can lead to arithmetic overflows leading to invalid memory allocations, which can be leverage to heap-based overflows in several code paths.
— Red Hat
In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-14308?
CVE-2020-14308 is a vulnerability in grub2, the GRand Unified Bootloader, which allows for heap-based overflow due to a flaw in the memory allocator.
How does CVE-2020-14308 affect Red Hat Enterprise Linux?
CVE-2020-14308 affects Red Hat Enterprise Linux 7 and 8, as it is present in the shipped versions of grub2.
What is the severity of CVE-2020-14308?
CVE-2020-14308 has a severity level of medium with a CVSS score of 6.4.
How can I fix CVE-2020-14308?
To fix CVE-2020-14308, you need to update grub2 to version 2.06 or higher.
Where can I find more information about CVE-2020-14308?
You can find more information about CVE-2020-14308 on the Red Hat Security Advisory and CVE websites.