CVE-2020-15706: GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.
"grub2 contains a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing."
Other sources
GRUB2 contains a race condition in grubscriptfunctioncreate() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-15706?
CVE-2020-15706 is rated as a medium severity vulnerability due to the potential for exploitation leading to use-after-free conditions.
How do I fix CVE-2020-15706?
To remediate CVE-2020-15706, update to the patched versions of grub2, shim, and other affected packages as specified by your Linux distribution.
Which affected software versions are impacted by CVE-2020-15706?
CVE-2020-15706 impacts several versions of grub2, fwupdate, shim, and shim-signed on Red Hat and other Linux distributions.
What type of vulnerability is CVE-2020-15706?
CVE-2020-15706 is a use-after-free vulnerability caused by a race condition in the grub_script_function_create() function.
Who is affected by CVE-2020-15706?
Users of affected versions of grub2 and related packages on Red Hat and other Linux distributions are at risk from CVE-2020-15706.