If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature validation. The booted kernel will think it was booted in secureboot mode and will implement lockdown, yet it could have been tampered. This flaw is a reintroduction of CVE-2020-15705 and only affects grub2 versions prior to 2.06 and upstream and distributions using the shim_lock mechanism.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs
    a length calculation on the assumption that expressing a quoted single quote will require 3 characters,
    while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each
    quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as
    well as system availability. (CVE-2021-20233)

  - A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper
    the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to
    load an untrusted or modified kernel, an attacker would first need to establish access to the system such
    as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a
    networked system with root access. With this access, an attacker could then craft a string to cause a
    buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The
    highest threat from this vulnerability is to data confidentiality and integrity as well as system
    availability. (CVE-2020-10713)

  - In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on
    the requested allocation size. This leads the function to return invalid memory allocations which can be
    further used to cause possible integrity, confidentiality and availability impacts during the boot
    process. (CVE-2020-14308)

  - There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a
    symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow
    leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled
    data. (CVE-2020-14309)

  - There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font
    name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer
    allocation to read the value from the font value. An attacker may leverage that by crafting a malicious
    font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow,
    zero-sized allocation and further heap-based buffer overflow. (CVE-2020-14310)

An update of the grub2 package has been released.

The remote Windows host is missing an update to the Secure Boot DBX. It is, therefore, affected by multiple vulnerabilities:

  - A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows     the unloading of a module used as a dependency without checking if any other dependent     module is still loaded leading to a use-after-free scenario. This could allow arbitrary     code to be executed or a bypass of Secure Boot protections. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25632)

  - A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu     rendering code performs a length calculation on the assumption that expressing a quoted     single quote will require 3 characters, while it actually requires 4 characters which     allows an attacker to corrupt memory by one byte for each quote in the input. The     highest threat from this vulnerability is to data confidentiality and integrity as     well as system availability. (CVE-2021-20233)


Additionally, the host is affected by several other security feature bypasses in Secure Boot.

Note: Tenable is testing for the presence of the expected signatures added in the DBX update published on March 2, 2021 referenced in the vendor advisory.

ID	Name	Product	Family	Type	Severity
423933	Alpine: multiple grub packages: security update to 2.06-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
423933	Alpine: multiple grub packages: security update to 2.06-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
148339	Photon OS 2.0: Grub2 PHSA-2021-2.0-0334	Nessus	PhotonOS Local Security Checks	Local	high
148024	Photon OS 4.0: Grub2 PHSA-2021-4.0-0001	Nessus	PhotonOS Local Security Checks	Local	high
146996	Photon OS 3.0: Grub2 PHSA-2021-3.0-0202	Nessus	PhotonOS Local Security Checks	Local	high
139239	Windows Security Feature Bypass in Secure Boot (BootHole)	Nessus	Windows	Local	high

Detections

Analytics

CVE-2021-3418

medium

Tenable Plugins

high

high

high

high

high

high