CVE-2020-15707: GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.
Integer overflows were discovered in the functions grubcmdinitrd and grubinitrdinit in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.
Other sources
There are a few integer overflows in grub2 while handling several sizes related to initrd information. These could be triggered by a crafted filesystem with very large files.
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-15707?
CVE-2020-15707 has a high severity rating due to its potential to cause heap-based buffer overflows.
How do I fix CVE-2020-15707?
To fix CVE-2020-15707, update affected packages such as grub2 to the recommended versions provided by your distribution.
Which products are affected by CVE-2020-15707?
CVE-2020-15707 affects various systems using GRUB2, including Debian, Red Hat, and Ubuntu distributions.
What types of vulnerabilities does CVE-2020-15707 involve?
CVE-2020-15707 involves integer overflows that can lead to heap-based buffer overflow vulnerabilities.
Is there a known exploit for CVE-2020-15707?
As of now, specific exploits for CVE-2020-15707 have not been publicly disclosed, but the vulnerability itself poses a significant risk.