CVE-2020-15706

Katalog CVE

CVSS 6.4 · Medium EPSS 0,98%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada gnu grub2, redhat enterprise linux atomic host +12 lainnya. Skor CVSS 3.1 6.4 (Medium) menurut NVD.

Deskripsi (NVD)

GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.

Rincian

Terbit di NVD

29 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.4 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-416: Use After Free

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html issue tracking · advisory vendor
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011 patch · advisory pihak ketiga · advisory vendor
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html broken link · mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html broken link · mailing list · advisory pihak ketiga
• http://ubuntu.com/security/notices/USN-4432-1 advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/07/29/3 mailing list · advisory pihak ketiga
• https://access.redhat.com/security/vulnerabilities/grub2bootloader advisory pihak ketiga
• https://security.gentoo.org/glsa/202104-05 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200731-0008/ advisory pihak ketiga
• https://usn.ubuntu.com/4432-1/ advisory pihak ketiga
• https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass advisory pihak ketiga
• https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4735 advisory pihak ketiga
• https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/ advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2020/07/29/3 mailing list · advisory pihak ketiga
• https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/ advisory pihak ketiga
• https://www.suse.com/support/kb/doc/?id=000019673 advisory pihak ketiga