VDB

CVE-2020-15705

CVE-2020-15705 PUBLISHED CVSS 6.400000095367432 MEDIUM

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.

EPSS 1.39% · 71.2th percentile

Risk Scores

CVSS 3.1
6.400000095367432
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score
1.39%
71.2th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSgrub20, *, *
Ubuntu:18.04:LTSgrub2-signed1.93.1, 0, 1.85
Ubuntu:18.04:LTSgrub22.02-2ubuntu1, 2.02-2ubuntu4, 2.02-2ubuntu8.7
Ubuntu:16.04:LTSgrub2-signed1.66.2, 1.66.1, 1.64
Ubuntu:Pro:14.04:LTSgrub2-signed1.34.9, 0, 1.22
Ubuntu:Pro:14.04:LTSgrub22.02~beta2-9ubuntu1.8, 2.02~beta2-9ubuntu1.7, 2.02~beta2-9ubuntu1.6
Ubuntu:20.04:LTSgrub22.04-1ubuntu13, 2.04-1ubuntu26, 2.04-1ubuntu25
Ubuntu:16.04:LTSgrub2-unsigned2.04-1ubuntu44, 2.04-1ubuntu44.1, 2.04-1ubuntu44.1.2
Ubuntu:20.04:LTSgrub2-signed1.135, 1.134, 1.133

Timeline

  • Jul 29, 2020 CVE Published
  • Apr 14, 2021 EPSS Score
  • May 1, 2021 EPSS Score
  • Aug 25, 2021 EPSS Score
  • Sep 17, 2021 EPSS Score
  • Sep 18, 2021 EPSS Score
  • Oct 11, 2021 EPSS Score
  • Oct 27, 2021 EPSS Score
  • Dec 29, 2021 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Mar 2, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›