4.6
CVSSv2

CVE-2020-10713

Published: 30/07/2020 Updated: 01/05/2021
CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9
CVSS v3 Base Score: 8.2 | Impact Score: 6 | Exploitability Score: 1.5
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

On July 29, 2020, a research paper titled “There’s a Hole in the Boot” was made publicly available. This paper discusses a vulnerability discovered in the GRand Unified Bootloader version 2 (GRUB2) bootloader that may allow an malicious user to execute arbitrary code at system boot time. The vulnerability is due to incorrect bounds checking of certain values parsed from the GRUB2 configuration file. An attacker could exploit this vulnerability by supplying a crafted configuration file for GRUB2. When this file is processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the malicious user to inject arbitrary code that is executed before the operating system is loaded on the targeted system. On systems protected by the Unified Extensible Firmware Interface (UEFI) secure boot feature, exploitation of this vulnerability may allow the malicious user to tamper with the secure boot process. Multiple Cisco wireless products are affected by this vulnerability. Cisco will release software updates that address this vulnerability. Any workarounds for a specific Cisco product or service will be documented in the relevant Cisco bugs, which are identified in the Vulnerable Products section of this advisory. This advisory will be updated as additional information becomes available. This advisory is available at the following link:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-grub2-code-exec-xLePCAPY

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

gnu grub2

Vendor Advisories

Synopsis Important: redhat-release-virtualization-host and redhat-virtualization-host security update Type/Severity Security Advisory: Important Topic An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 ...
Synopsis Important: Red Hat Virtualization security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update for cockpit-ovirt, imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise ...
Synopsis Moderate: grub2 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, shim-signed, and fwupdate is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerabi ...
Synopsis Moderate: grub2 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, shim-signed, and fwupdate is now available for Red Hat Enterprise Linux 76 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Mo ...
Synopsis Moderate: grub2 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, and shim-signed is now available for Red Hat Enterprise Linux 73 Advanced Update Support, Red Hat Enterprise Linux 73 Telco Extended Update Support, and Red Hat Enterprise Linux ...
Synopsis Moderate: grub2 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, shim-signed, and fwupdate is now available for Red Hat Enterprise Linux 74 Advanced Update Support, Red Hat Enterprise Linux 74 Telco Extended Update Support, and Red Hat Enterpr ...
Synopsis Moderate: grub2 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, and shim-signed is now available for Red Hat Enterprise Linux 72 Advanced Update SupportRed Hat Product Security has rated this update as having a security impact of Moderate A ...
On July 29, 2020, a research paper titled “There’s a Hole in the Boot” was made publicly available This paper discusses a vulnerability discovered in the GRand Unified Bootloader version 2 (GRUB2) bootloader that may allow an attacker to execute arbitrary code at system boot time The vulnerability is due to incorrect bounds checking of cert ...
Synopsis Moderate: kernel security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for kernel is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base ...
Synopsis Moderate: grub2 security update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, and fwupd is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Moderate A Common V ...
Synopsis Moderate: grub2 security and bug fix update Type / Sévérité Security Advisory: Moderate Sujet An update for grub2, shim, shim-signed, and fwupdate is now available for Red Hat Enterprise Linux 77 Extended Update SupportRed Hat Product Security has rated this update as having a security impact ...
Synopsis Moderate: grub2 security update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, shim-unsigned-x64, and fwupd is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scor ...
Synopsis Moderate: grub2 security update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, shim-unsigned-x64, and fwupd is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Moderate A ...
Synopsis Moderate: kernel-rt security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 77 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabili ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) b ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...
Several vulnerabilities have been discovered in the GRUB2 bootloader CVE-2020-10713 A flaw in the grubcfg parsing code was found allowing to break UEFI Secure Boot and load arbitrary code Details can be found at wwweclypsiumcom/2020/07/29/theres-a-hole-in-the-boot/ CVE-2020-14308 It was discovered that grub_malloc does ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabili ...

Mailing Lists

[This message expands slightly on the post to the distros list on 2020-07-20] Hello All, There are several CVEs both in GRUB2 and the Linux kernel (details below) that compromise UEFI Secure boot and kernel lockdown * These bugs allow unsigned code to be booted and run on hardware configured to prevent that * Affected vendors will be pu ...

Github Repositories

Fork of https://github.com/rhboot/shim-review/

This repo is for review of requests for signing shim To create a request for review: clone this repo edit the template below add the shimefi to be signed add build logs commit all of that tag it with a tag of the form "myorg-shim-arch-YYYYMMDD" push that to github file an issue at githubcom/rhboot/shim-review/issues with a link to your tag Note that we r

Reviews of shim

This repo is for review of requests for signing shim To create a request for review: clone this repo edit the template below add the shimefi to be signed add build logs add any additional binaries/certificates/hashes that may be needed commit all of that tag it with a tag of the form "myorg-shim-arch-YYYYMMDD" push that to github file an issue at githubco

Shim signatures (SHA-256) for released Red Hat / CentOS kernels.

Red Hat / CentOS kernel shim signatures This git repository contains shim signatures (SHA-256) for all released RHEL and CentOS versions Description Due to hardening within the Red Hat Enterprise Linux 8 kernel, which was released as part of the CVE-2020-10713 update, previous Red Hat Enterprise Linux 8 kernel versions have not been added to shim’s allow list If you are

To send TWO shim loader to review

This repo is for review of requests for signing shim To create a request for review: clone this repo edit the template below add the shimefi to be signed add build logs add any additional binaries/certificates/hashes that may be needed commit all of that tag it with a tag of the form "myorg-shim-arch-YYYYMMDD" push that to github file an issue at githubco

TmaxOS shim review

This repo is for review of requests for signing shim To create a request for review: clone this repo edit the template below add the shimefi to be signed add build logs add any additional binaries/certificates/hashes that may be needed commit all of that tag it with a tag of the form "myorg-shim-arch-YYYYMMDD" push that to github file an issue at githubco

This repo is for review of requests for signing shim To create a request for review: clone this repo edit the template below add the shimefi to be signed add build logs add any additional binaries/certificates/SHA256 hashes that may be needed commit all of that tag it with a tag of the form "myorg-shim-arch-YYYYMMDD" push that to github file an issue at gi

This repo is for review of requests for signing shim To create a request for review: clone this repo edit the template below add the shimefi to be signed add build logs add any additional binaries/certificates/SHA256 hashes that may be needed commit all of that tag it with a tag of the form "myorg-shim-arch-YYYYMMDD" push that to github file an issue at gi

This repo is for review of requests for signing shim To create a request for review: clone this repo edit the template below add the shimefi to be signed add build logs add any additional binaries/certificates/SHA256 hashes that may be needed commit all of that tag it with a tag of the form "myorg-shim-arch-YYYYMMDD" push that to github file an issue at gi

Kaosagnt's Ansible Everyday Utils

Kaosagnt's Ansible Everyday Utils This project contains many of the Ansible playbooks that I use daily as a Systems Administrator in the pursuit of easy server task automation Installation You will need to setup and install Ansible like you normally would before using what is presented here Hint: it uses ansible wwwansiblecom Optional: Create an ansible-everyd

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享,作为笔记吧,欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&Mobile

公开收集所用

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享,作为笔记吧,欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&Mobile

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享,作为笔记吧,欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&Mobile

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享,作为笔记吧,欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&Mobile

渗透测试有关的POC、EXP、脚本、提权、小工具等,欢迎补充、完善---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss penetration-testing-poc csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypass oa-getshell cve-cms

Penetration_Testing_POC 搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享,作为笔记吧,欢迎补充。 Penetration_Testing_POC 请善用搜索[Ctrl+F]查找 IOT Device&Mobile Phone Web APP 提权辅助相关 PC tools-小工具集合 文章/书籍/教程相关 说明 请善用搜索[Ctrl+F]查找 IOT Device&Mobile

PoC in GitHub 2021 CVE-2021-1056 (2021-01-07) NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer (nvidiako) in which it does not completely honor operating system file system permissions to provide GPU device-level isolation, which may lead to denial of service or information disclosure pokerfaceSad/CVE-2021-1056 CVE-2021-

PoC in GitHub 2020 CVE-2020-0014 It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable This could lead to a local escalation of privilege with no additional execution privileges needed User action is needed for exploitationProduct: AndroidVersions: Android-80 Android-81 Android-9 Android-10Android ID: A-1286745

PoC in GitHub 2020 CVE-2020-0014 (2020-02-13) It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable This could lead to a local escalation of privilege with no additional execution privileges needed User action is needed for exploitationProduct: AndroidVersions: Android-80 Android-81 Android-9 Android-10Android

PoC auto collect from GitHub.

PoC in GitHub 2020 CVE-2020-0022 In reassemble_and_dispatch of packet_fragmentercc, there is possible out of bounds write due to an incorrect bounds calculation This could lead to remote code execution over Bluetooth with no additional execution privileges needed User interaction is not needed for exploitationProduct: AndroidVersions: Android-80 Android-81 Android-9 Andr

Recent Articles

Billions of Devices Impacted by Secure Boot Bypass
Threatpost • Tara Seals • 29 Jul 2020

Billions of Windows and Linux devices are vulnerable to cyberattacks stemming from a bug in the GRUB2 bootloader, researchers are warning.
GRUB2 (which stands for the GRand Unified Bootloader version 2) is the default bootloader for the majority of computing systems. Its job is to manage part of the start-up process – it either presents a menu and awaits user input, or automatically transfers control to an operating system kernel.
Secure Boot is an industry standard that ensures th...

GRUB2, you're getting too bug for your boots: Config file buffer overflow is a boon for malware seeking to drill deeper into a system
The Register • Shaun Nichols in San Francisco • 29 Jul 2020

We're gonna keeping punning this until someone pays us $5m

An annoying vulnerability in the widely used GRUB2 bootloader can be potentially exploited by malware or a rogue insider already on a machine to thoroughly compromise the operating system or hypervisor while evading detection by users and security tools.
This affects mainly Linux-based computers and devices, where GRUB2 is deployed a lot, though boxes running Windows can be potentially roped in, too. Any system on which GRUB2 can be installed and run at boot-time is potentially vulnerable....

The Register

An annoying vulnerability in the widely used GRUB2 bootloader can be potentially exploited by malware or a rogue insider already on a machine to thoroughly compromise the operating system or hypervisor while evading detection by users and security tools.
This affects mainly Linux-based computers and devices, where GRUB2 is deployed a lot, though boxes running Windows can be potentially roped in, too. Any system on which GRUB2 can be installed and run at boot-time is potentially vulnerable....

BootHole GRUB bootloader bug lets hackers hide malware in Linux, Windows
BleepingComputer • Ionut Ilascu • 01 Jan 1970

A severe vulnerability exists in almost all signed versions of GRUB2 bootloader used by most Linux systems. When properly exploited, it could allow threat actors to compromise an operating system’s booting process even if the Secure Boot verification mechanism is active.
Aptly named BootHole, the flaw permits executing arbitrary code in
. An attacker could use it to plant malware known as bootkit that loads before the operating system (OS).
Compromising a system this way con...