ALPINE-CVE-2020-27749
Record from OSV · Published March 3, 2021
A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution which could also circumvent Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| grub | Alpine:v3.19 | 2.06-r0 |
| grub | Alpine:v3.22 | 2.06-r0 |
| grub | Alpine:v3.17 | 2.06-r0 |
| grub | Alpine:v3.21 | 2.06-r0 |
| grub | Alpine:v3.23 | 2.06-r0 |
| grub | Alpine:v3.18 | 2.06-r0 |
| grub | Alpine:v3.24 | 2.06-r0 |
| grub | Alpine:v3.20 | 2.06-r0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.19 | grub | 2.02-r15, 2.02-r11, 2.04-r1 |
| Alpine:v3.22 | grub | 2.02_beta3-r6, 2.02_beta3-r0, 2.02-r14 |
| Alpine:v3.17 | grub | 2.02-r17, 0, 2.02-r0 |
| Alpine:v3.21 | grub | 2.04-r0, 2.02-r13, 0 |
| Alpine:v3.23 | grub | 2.02-r9, 2.02-r1, 2.02-r10 |
| Alpine:v3.18 | grub | 2.04-r0, 0, 2.02-r0 |
| Alpine:v3.24 | grub | 0 |
| Alpine:v3.20 | grub | 0, 2.04-r0, 2.02-r1 |
Timeline
- Mar 3, 2021 CVE Published
- Aug 5, 2026 CVE Updated
- Aug 8, 2026 Distribution Patch
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln ALPINE-CVE-2020-27749
vulnetix vdb fixes ALPINE-CVE-2020-27749Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/ALPINE-CVE-2020-27749/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart