CVE-2020-14310LOW
Description
There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14310
https://usn.ubuntu.com/4432-1/
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html
Details
Source: MITRE
Published: 2020-07-31
Updated: 2021-05-01
Type: CWE-190
Risk Information
CVSS v2.0
Base Score: 3.6
Vector: AV:L/AC:L/Au:N/C:N/I:P/A:P
Impact Score: 4.9
Exploitability Score: 3.9
Severity: LOW
CVSS v3.0
Base Score: 6
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Impact Score: 5.2
Exploitability Score: 0.8
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
Configuration 2
OR
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 149217 | GLSA-202104-05 : GRUB: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
| 147445 | EulerOS Virtualization 2.9.1 : grub2 (EulerOS-SA-2021-1601) | Nessus | Huawei Local Security Checks | medium |
| 147274 | NewStart CGSL CORE 5.04 / MAIN 5.04 : grub2 Multiple Vulnerabilities (NS-SA-2021-0008) | Nessus | NewStart CGSL Local Security Checks | medium |
| 146030 | CentOS 8 : grub2 (CESA-2020:3216) | Nessus | CentOS Local Security Checks | medium |
| 140948 | EulerOS Virtualization for ARM 64 3.0.6.0 : grub2 (EulerOS-SA-2020-2000) | Nessus | Huawei Local Security Checks | medium |
| 139956 | EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2020-1853) | Nessus | Huawei Local Security Checks | medium |
| 139449 | openSUSE Security Update : grub2 (openSUSE-2020-1169) | Nessus | SuSE Local Security Checks | medium |
| 139448 | openSUSE Security Update : grub2 (openSUSE-2020-1168) | Nessus | SuSE Local Security Checks | medium |
| 139365 | Ubuntu 16.04 LTS / 18.04 LTS / 20.04 : GRUB2 regression (USN-4432-2) | Nessus | Ubuntu Local Security Checks | medium |
| 139294 | RHEL 7 : grub2 (RHSA-2020:3274) | Nessus | Red Hat Local Security Checks | medium |
| 139288 | RHEL 7 : grub2 (RHSA-2020:3271) | Nessus | Red Hat Local Security Checks | medium |
| 139287 | RHEL 7 : grub2 (RHSA-2020:3276) | Nessus | Red Hat Local Security Checks | medium |
| 139284 | RHEL 7 : grub2 (RHSA-2020:3273) | Nessus | Red Hat Local Security Checks | medium |
| 139283 | RHEL 7 : grub2 (RHSA-2020:3275) | Nessus | Red Hat Local Security Checks | medium |
| 139243 | Photon OS 2.0: Grub2 PHSA-2020-2.0-0267 | Nessus | PhotonOS Local Security Checks | medium |
| 139242 | Photon OS 1.0: Grub2 PHSA-2020-1.0-0311 | Nessus | PhotonOS Local Security Checks | medium |
| 139239 | Windows Security Feature Bypass in Secure Boot (BootHole) | Nessus | Windows | medium |
| 139236 | CentOS 7 : grub2 (CESA-2020:3217) | Nessus | CentOS Local Security Checks | medium |
| 139198 | RHEL 7 : grub2 (RHSA-2020:3217) | Nessus | Red Hat Local Security Checks | medium |
| 139194 | RHEL 8 : grub2 (RHSA-2020:3216) | Nessus | Red Hat Local Security Checks | medium |
| 139193 | RHEL 8 : grub2 (RHSA-2020:3223) | Nessus | Red Hat Local Security Checks | medium |
| 139192 | RHEL 8 : grub2 (RHSA-2020:3227) | Nessus | Red Hat Local Security Checks | medium |
| 139179 | Ubuntu 16.04 LTS / 18.04 LTS / 20.04 : GRUB 2 vulnerabilities (USN-4432-1) | Nessus | Ubuntu Local Security Checks | medium |
| 139178 | SUSE SLES12 Security Update : grub2 (SUSE-SU-2020:2079-1) | Nessus | SuSE Local Security Checks | medium |
| 139177 | SUSE SLES12 Security Update : grub2 (SUSE-SU-2020:2078-1) | Nessus | SuSE Local Security Checks | medium |
| 139176 | SUSE SLED15 / SLES15 Security Update : grub2 (SUSE-SU-2020:2077-1) | Nessus | SuSE Local Security Checks | medium |
| 139175 | SUSE SLES12 Security Update : grub2 (SUSE-SU-2020:2076-1) | Nessus | SuSE Local Security Checks | medium |
| 139174 | SUSE SLED15 / SLES15 Security Update : grub2 (SUSE-SU-2020:2074-1) | Nessus | SuSE Local Security Checks | medium |
| 139173 | SUSE SLES15 Security Update : grub2 (SUSE-SU-2020:2073-1) | Nessus | SuSE Local Security Checks | medium |
| 139165 | Oracle Linux 8 : grub2 (ELSA-2020-5786) | Nessus | Oracle Linux Local Security Checks | high |
| 139164 | Oracle Linux 7 : grub2 (ELSA-2020-5782) | Nessus | Oracle Linux Local Security Checks | high |
| 139099 | Debian DSA-4735-1 : grub2 - security update | Nessus | Debian Local Security Checks | medium |