The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3273 advisory.

  - grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process (CVE-2020-10713)

  - grub2: grub_malloc does not validate allocation size allowing for arithmetic overflow and subsequent heap-     based buffer overflow (CVE-2020-14308)

  - grub2: Integer overflow in grub_squash_read_symlink may lead to heap-based buffer overflow     (CVE-2020-14309)

  - grub2: Integer overflow read_section_as_string may lead to heap-based buffer overflow (CVE-2020-14310)

  - grub2: Integer overflow in grub_ext2_read_link leads to heap-based buffer overflow (CVE-2020-14311)

  - grub2: Fail kernel validation without shim protocol (CVE-2020-15705)

  - grub2: Use-after-free redefining a function whilst the same function is already executing (CVE-2020-15706)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : grub2 (RHSA-2020:3273)

high Nessus Plugin ID 139284

Version 1.13

Version 1.12

Version 1.11

Version 1.10

Version 1.13 Apr 28, 2024, 2:25 PM Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404281425
Version 1.12 May 25, 2023, 5:09 PM Logic Changes (Added support for ppc64le architecture) Plugin Feed: 202305251709
Version 1.11 Jan 23, 2023, 7:12 PM Logic Changes (Added support for repository relative URLs) Plugin Feed: 202301231912
Version 1.10 Dec 6, 2022, 6:53 AM Reference Plugin Feed: 202212060653