4.6
CVSSv2

CVE-2020-10713

Published: 30/07/2020 Updated: 08/08/2020
CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

GNU GRUB2 could allow a local authenticated malicious user to execute arbitrary code on the system, caused by a "BootHole" vulnerability. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code within GRUB.

Vulnerability Trend

Affected Products

Vendor Product Versions
GnuGrub2-, 1.98, 1.99, 2.00, 2.01, 2.02, 2.04

Vendor Advisories

Synopsis Moderate: grub2 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, and shim-signed is now available for Red Hat Enterprise Linux 73 Advanced Update Support, Red Hat Enterprise Linux 73 Telco Extended Update Support, and Red Hat Enterprise Linux ...
Synopsis Moderate: grub2 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, shim-signed, and fwupdate is now available for Red Hat Enterprise Linux 74 Advanced Update Support, Red Hat Enterprise Linux 74 Telco Extended Update Support, and Red Hat Enterpr ...
Synopsis Moderate: grub2 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, and shim-signed is now available for Red Hat Enterprise Linux 72 Advanced Update SupportRed Hat Product Security has rated this update as having a security impact of Moderate A ...
Synopsis Moderate: grub2 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, shim-signed, and fwupdate is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerabi ...
Synopsis Moderate: grub2 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, shim-signed, and fwupdate is now available for Red Hat Enterprise Linux 76 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Mo ...
Synopsis Moderate: grub2 security update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, shim-unsigned-x64, and fwupd is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scor ...
Synopsis Moderate: grub2 security update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, shim-unsigned-x64, and fwupd is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Moderate A ...
Synopsis Moderate: kernel security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for kernel is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base ...
On July 29, 2020, a research paper titled “There’s a Hole in the Boot” was made publicly available This paper discusses a vulnerability discovered in the GRand Unified Bootloader version 2 (GRUB2) bootloader that may allow an attacker to execute arbitrary code at system boot time The vulnerability is due to incorrect bounds checking of cert ...
Synopsis Moderate: grub2 security update Type/Severity Security Advisory: Moderate Topic An update for grub2, shim, and fwupd is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Moderate A Common V ...
Synopsis Moderate: grub2 security and bug fix update Type / Sévérité Security Advisory: Moderate Sujet An update for grub2, shim, shim-signed, and fwupdate is now available for Red Hat Enterprise Linux 77 Extended Update SupportRed Hat Product Security has rated this update as having a security impact ...
Synopsis Moderate: kernel-rt security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 77 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabili ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) b ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...
Several vulnerabilities have been discovered in the GRUB2 bootloader CVE-2020-10713 A flaw in the grubcfg parsing code was found allowing to break UEFI Secure Boot and load arbitrary code Details can be found at wwweclypsiumcom/2020/07/29/theres-a-hole-in-the-boot/ CVE-2020-14308 It was discovered that grub_malloc does ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabili ...

Mailing Lists

[This message expands slightly on the post to the distros list on 2020-07-20] Hello All, There are several CVEs both in GRUB2 and the Linux kernel (details below) that compromise UEFI Secure boot and kernel lockdown * These bugs allow unsigned code to be booted and run on hardware configured to prevent that * Affected vendors will be pu ...

Github Repositories

master 1 branch 0 tags Go to file Code Clone with HTTPS Use Git or checkout with SVN using the web URL. Download ZIP Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Go back Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Go back Launching Xcode If nothing happens, download Xcode and try again. Go back Launching Visual Studio If nothing happens, download the GitHub extension for Visual Studio and try again. Go back Latest commit wrffrz add link to grub patch series fixing these issues … e91124c 5 minutes ago add link to grub patch series fixing these issues e91124c Git stats 7 commits Files Permalink Failed to load latest commit information. Type Name Latest commit message Commit time Bash Initial Commit 1 hour ago Powershell Initial Commit 1 hour ago ADVISORIES.md add link to grub patch series fixing these issues 5 minutes ago LICENSE Initial commit 17 hours ago README.md Update README.md 1 hour ago View code README.md BootHole General information This repository was created to contain relevant helpful scripts and any additional tools or information that can assist others in managing their BootHole vulnerability mitigation plans. Windows Based Platforms We have created a Powershell script that will check the EFI System Partition for signed executable files that were revoked by Microsoft in the BootHole DBX Update Linux Based Platforms Similarly to the Windows Powershell script above, we have also created a Linux Bash script that will check for any signed executable files revoked in the BootHole DBX update . If you encounter any issues please report them and we will try our best to assist you as soon as we can. About This repository contains scripts , links and other related materials that may aid in detecting and mitigating the BootHole vulnerability (CVE-2020-10713) Resources Readme License GPL-3.0 License Releases No releases published Contributors 2 wrffrz wrffrz eclypsium eclypsium Languages Shell 63.5% PowerShell 36.5%

Recent Articles

Billions of Devices Impacted by Secure Boot Bypass
Threatpost • Tara Seals • 29 Jul 2020

Billions of Windows and Linux devices are vulnerable to cyberattacks stemming from a bug in the GRUB2 bootloader, researchers are warning.
GRUB2 (which stands for the GRand Unified Bootloader version 2) is the default bootloader for the majority of computing systems. Its job is to manage part of the start-up process – it either presents a menu and awaits user input, or automatically transfers control to an operating system kernel.
Secure Boot is an industry standard that ensures th...

BootHole GRUB bootloader bug lets hackers hide malware in Linux, Windows
BleepingComputer • Ionut Ilascu • 29 Jul 2020

A severe vulnerability exists in almost all signed versions of GRUB2 bootloader used by most Linux systems. When properly exploited, it could allow threat actors to compromise an operating system’s booting process even if the Secure Boot verification mechanism is active.
Aptly named BootHole, the flaw permits executing arbitrary code in GRUB bootloader. An attacker could use it to plant malware known as bootkit that loads before the operating system (OS).


...

The Register

An annoying vulnerability in the widely used GRUB2 bootloader can be potentially exploited by malware or a rogue insider already on a machine to thoroughly compromise the operating system or hypervisor while evading detection by users and security tools.
This affects mainly Linux-based computers and devices, where GRUB2 is deployed a lot, though boxes running Windows can be potentially roped in, too. Any system on which GRUB2 can be installed and run at boot-time is potentially vulnerable....