CVE-2020-15705: GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim
GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.
Other sources
If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature validation. The booted kernel will think it was booted in secureboot mode and will implement lockdown, yet it could have been tampered.
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-15705.
What is the severity of CVE-2020-15705?
The severity of CVE-2020-15705 is medium (6.4).
Which systems are affected by this vulnerability?
This vulnerability affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim.
How can this vulnerability be exploited?
This vulnerability allows secure boot to be bypassed by failing to validate kernel signature when booted directly without shim.
Where can I find more information about CVE-2020-15705?
You can find more information about CVE-2020-15705 on the Red Hat website (https://access.redhat.com/security/cve/cve-2020-15705).