Vulnetix
Try Vulnetix Request Demo
CVE-2020-15706 PUBLISHED

GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.

EPSS 0.05% · 16.2th percentile

Risk Scores

EPSS Score
0.05%
16.2th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:14.04:LTSgrub20, 2.00-19ubuntu2, 2.00-19ubuntu3
Ubuntu:18.04:LTSgrub22.02-2ubuntu7, 2.02-2ubuntu6, 2.02-2ubuntu4
Ubuntu:18.04:LTSgrub2-signed1.93.7, 1.93.16, 1.93.15
Ubuntu:Pro:14.04:LTSgrub2-signed1.34.1, 1.27, 1.26
Ubuntu:16.04:LTSgrub2-signed1.66, 1.66.1, 1.66.2
Ubuntu:20.04:LTSgrub2-signed1.142.1, 0, 1.128
Ubuntu:20.04:LTSgrub22.04-1ubuntu12, 2.04-1ubuntu13, 2.04-1ubuntu14
Ubuntu:16.04:LTSgrub22.02~beta2-32ubuntu1, 2.02~beta2-32, 2.02~beta2-31ubuntu1
Ubuntu:16.04:LTSgrub2-unsigned2.04-1ubuntu44.1.2, 2.04-1ubuntu44.1, 2.04-1ubuntu44

Timeline

References

Open in Interactive Console →