CVE-2020-27749: High severity centos grub2-pc-modules vulnerability
A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution which could also circumvent Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
grubparsersplitcmdline expands variable names present in the supplied command line in to their corresponding variable contents and uses a 1kB stack buffer for temporary storage without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution. An attacker may use this to circumvent Secure Boot protections.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-27749?
CVE-2020-27749 is a vulnerability found in grub2 versions prior to 2.06.
What is the severity of CVE-2020-27749?
CVE-2020-27749 has a severity level of high.
How does CVE-2020-27749 affect the affected software?
CVE-2020-27749 affects the grub2 package in Redhat Enterprise Linux, Gnu Grub2, and other related products.
How can I fix CVE-2020-27749?
To fix CVE-2020-27749, update the grub2 package to version 2.06 or higher.
Where can I find more information about CVE-2020-27749?
You can find more information about CVE-2020-27749 in the following references: [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1899966), [Fedora Project](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/), [Gentoo Security](https://security.gentoo.org/glsa/202104-05).