SB2021050105 - Gentoo update for GRUB
Published: May 1, 2021 Updated: July 20, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 secuirty vulnerabilities.
1) Out-of-bounds Write (CVE-ID: CVE-2020-10713)
The vulnerability allows a local attacker to compromise vulnerable system.
The vulnerability exists due to a "BootHole" issue. An attacker with physical access can install persistent and stealthy bootkits or malicious bootloaders, trigger out-of-bounds write and execute arbitrary code on the target system.
2) Heap-based buffer overflow (CVE-ID: CVE-2020-14308)
The vulnerability allows a local attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. An attacker with physical access can trigger heap-based buffer overflow and execute arbitrary code on the target system during the boot process.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Integer overflow (CVE-ID: CVE-2020-14309)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow when handling symlinks on ext filesustem in grub_squash_read_symlink() function. A local user can create a specially crafted symlink, trigger an integer overflow and crash the system.
4) Integer overflow (CVE-ID: CVE-2020-14310)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the read_section_as_string() function when processing font names. A local user can create a specially crafted font name, trigger integer overflow and crash the affected system.
5) Integer overflow (CVE-ID: CVE-2020-14311)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the grub_ext2_read_link() function when processing symlinks. A local user can create a specially crafted symlink, trigger integer overflow and crash the system.
6) Security restrictions bypass (CVE-ID: CVE-2020-14372)
The vulnerability allows a local privileged user to bypass implemented security restrictions.
The vulnerability exists due to GRUB enables usage of the acpi command even when Secure Boot is enabled by firmware. A local user with root privileges can put a small SSDT into /boot/efi folder and modify the grub.cfg file to load that SSDT during kernel boot. The SSDT then gets run by the kernel and it overwrites the kernel lock down configuration enabling the attacker to load unsigned kernel modules and kexec unsigned code.
7) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2020-15705)
The vulnerability allows a local attacker to compromise the target system.
The vulnerability exists due to the affected software fails to validate kernel signature when booted directly without shim. An attacker with physical access can bypass secure boot.
8) Race condition (CVE-ID: CVE-2020-15706)
The vulnerability allows a local attacker to execute arbitrary code and bypass secure boot restriction.
The vulnerability exists due to a race condition in the "grub_script_function_create()" function. An attacker with physical access can exploit the race and execute arbitrary code on the target system.
9) Integer overflow (CVE-ID: CVE-2020-15707)
The vulnerability allows a local attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in the "grub_cmd_initrd" and "grub_initrd_init" functions in the "efilinux" component. An attacker with physical access can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
10) Use-after-free (CVE-ID: CVE-2020-25632)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to a use-after-free error when handling module unloads. A local privileged user can unload a kernel module, trigger a use-after-free error and bypass Secure Boot protection mechanism.
11) Out-of-bounds write (CVE-ID: CVE-2020-25647)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error when processing untrusted input from USB device in grub_usb_device_initialize(). An attacker with physical access to the system can trigger an out-of-bounds write error with a malicious USB drive, bypass Secure Boot protection and execute arbitrary code on the system with elevated privileges.
12) Stack-based buffer overflow (CVE-ID: CVE-2020-27749)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the grub_parser_split_cmdline() function while expanding variable names present in the supplied command line in to their corresponding variable contents. A local privileged user can run a specially crafted program to trigger the stack-based buffer overflow and bypass Secure Boot protection.
13) Improper Authorization (CVE-ID: CVE-2020-27779)
The vulnerability allows a local user to bypass authorization checks.
The vulnerability exists within the cutmem command, which does not honor the Secure Boot locking. A local privileged user can remove address ranges from memory creating an opportunity to circumvent Secure Boot protections after proper triage about grub's memory layout.
14) Out-of-bounds write (CVE-ID: CVE-2021-20225)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the option parser. A local privileged user can write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options and execute arbitrary code with elevated privileges.
15) Out-of-bounds write (CVE-ID: CVE-2021-20233)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the setparam_prefix() function in menu rendering code. A local privileged user can run a specially crafted program to trigger out-of-bounds write and escalate privileges on the system.
Remediation
Install update from vendor's website.