CVE-2020-15705

Katalog CVE

CVSS 6.4 · Medium EPSS 1,4%

Kerentanan Improper Verification of Cryptographic Signature pada gnu grub2, redhat enterprise linux atomic host +12 lainnya. Skor CVSS 3.1 6.4 (Medium) menurut NVD.

Deskripsi (NVD)

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.

Rincian

Terbit di NVD

29 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.4 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html issue tracking · advisory vendor
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011 patch · advisory pihak ketiga · advisory vendor
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00067.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00069.html mailing list · advisory pihak ketiga
• http://ubuntu.com/security/notices/USN-4432-1 advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/07/29/3 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/03/02/3 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/09/17/2 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/09/17/4 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/09/21/1 mailing list · advisory pihak ketiga
• https://access.redhat.com/security/vulnerabilities/grub2bootloader advisory pihak ketiga
• https://security.gentoo.org/glsa/202104-05 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200731-0008/ advisory pihak ketiga
• https://usn.ubuntu.com/4432-1/ advisory pihak ketiga
• https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass advisory pihak ketiga
• https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot advisory pihak ketiga
• https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/ advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2020/07/29/3 mailing list · advisory pihak ketiga
• https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/ advisory pihak ketiga
• https://www.suse.com/support/kb/doc/?id=000019673 advisory pihak ketiga