Published: 15/03/2021 Updated: 22/03/2021

CVSS v2 Base Score: 4.4 | Impact Score: 6.4 | Exploitability Score: 3.4

CVSS v3 Base Score: 6.4 | Impact Score: 5.9 | Exploitability Score: 0.5

VMScore: 397

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature validation. The booted kernel will think it was booted in secureboot mode and will implement lockdown, yet it could have been tampered. This flaw is a reintroduction of CVE-2020-15705 and only affects grub2 versions before 2.06 and upstream and distributions using the shim_lock mechanism.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu grub2

No description is available for this CVE ...

The GRUB2 upstream reintroduced CVE-2020-15705 This refers to a distro specific flaw which upstream introduced in Grub 205 If certificates that signed GRUB2 are installed into db, GRUB2 can be booted directly It will then boot any kernel without signature validation The booted kernel will think it was booted in Secure Boot mode and will imple ...

HP has been informed of a potential security vulnerability in GRUB2 bootloaders commonly used by Linux This vulnerability, known as “There’s a Hole in the Boot” (also nicknamed “BootHole”), could allow bypass of UEFI Secure Boot and allow arbitrary code execution Additional GRUB2 vulnerabilities found in response to the initial report ...

oss-sec mailing list archives   By Date By Thread </form>    Multiple GRUB2 vulnerabilities   From: John Haxby <johnhaxby () oracl ...

CWE-281 https://bugzilla.redhat.com/show_bug.cgi?id=1933757 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2021-3418

CVE-2021-3418

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect