GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.
GRUB2 contiene una condición de carrera en la función grub_script_function_create() que conlleva a una vulnerabilidad de uso de la memoria previamente liberada la cual puede ser desencadenada al redefinir una función mientras la misma función ya se está ejecutando, conllevando a una ejecución de código arbitrario y a una omisión de restricción de arranque seguro. Este problema afecta a GRUB2 versiones 2.04 y versiones anteriores
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | HIGH |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:L/AC:M/Au:N/C:P/I:P/A:P
| Access Vector | LOCAL |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-362
|
| [email protected] | Primary |
en
CWE-362
en
CWE-416
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| gnu | grub2 | * | <built-in method update of dict object at 0x72a9cd08dbc0> | Application |
| redhat | enterprise_linux_atomic_host | - | <built-in method update of dict object at 0x72a961ec9e80> | Application |
| redhat | openshift_container_platform | 4.0 | <built-in method update of dict object at 0x72a963c69f80> | Application |
| canonical | ubuntu_linux | 14.04 | <built-in method update of dict object at 0x72a999778840> | Operating System |
| canonical | ubuntu_linux | 16.04 | <built-in method update of dict object at 0x72a9cd08db00> | Operating System |
| canonical | ubuntu_linux | 18.04 | <built-in method update of dict object at 0x72a9cd08f1c0> | Operating System |
| canonical | ubuntu_linux | 20.04 | <built-in method update of dict object at 0x72a9cd08dc00> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x72a9cd08ef00> | Operating System |
| redhat | enterprise_linux | 7.0 | <built-in method update of dict object at 0x72a9cc76d5c0> | Operating System |
| redhat | enterprise_linux | 8.0 | <built-in method update of dict object at 0x72a9cd08d180> | Operating System |
| suse | suse_linux_enterprise_server | 11 | <built-in method update of dict object at 0x72a9cd08d800> | Operating System |
| suse | suse_linux_enterprise_server | 12 | <built-in method update of dict object at 0x72a9cd08d1c0> | Operating System |
| suse | suse_linux_enterprise_server | 15 | <built-in method update of dict object at 0x72a961eca480> | Operating System |
| microsoft | windows_10 | - | <built-in method update of dict object at 0x72a9cc76d580> | Operating System |
| microsoft | windows_10 | 1607 | <built-in method update of dict object at 0x72a9cd08e0c0> | Operating System |
| microsoft | windows_10 | 1709 | <built-in method update of dict object at 0x72a9cd08fb80> | Operating System |
| microsoft | windows_10 | 1803 | <built-in method update of dict object at 0x72a9cd08c9c0> | Operating System |
| microsoft | windows_10 | 1809 | <built-in method update of dict object at 0x72a9997794c0> | Operating System |
| microsoft | windows_10 | 1903 | <built-in method update of dict object at 0x72a99977b9c0> | Operating System |
| microsoft | windows_10 | 1909 | <built-in method update of dict object at 0x72a99977bd80> | Operating System |
| microsoft | windows_10 | 2004 | <built-in method update of dict object at 0x72a9cc76dbc0> | Operating System |
| microsoft | windows_8.1 | - | <built-in method update of dict object at 0x72a961ec9b00> | Operating System |
| microsoft | windows_rt_8.1 | - | <built-in method update of dict object at 0x72a9cd08fdc0> | Operating System |
| microsoft | windows_server_2012 | - | <built-in method update of dict object at 0x72a9cc76ef40> | Operating System |
| microsoft | windows_server_2012 | r2 | <built-in method update of dict object at 0x72a999779ec0> | Operating System |
| microsoft | windows_server_2016 | - | <built-in method update of dict object at 0x72a961ec8fc0> | Operating System |
| microsoft | windows_server_2016 | 1903 | <built-in method update of dict object at 0x72a9cc76d500> | Operating System |
| microsoft | windows_server_2016 | 1909 | <built-in method update of dict object at 0x72a961ecb9c0> | Operating System |
| microsoft | windows_server_2016 | 2004 | <built-in method update of dict object at 0x72a963c68fc0> | Operating System |
| microsoft | windows_server_2019 | - | <built-in method update of dict object at 0x72a961eca800> | Operating System |
| opensuse | leap | 15.1 | <built-in method update of dict object at 0x72a9cd08ffc0> | Operating System |
| opensuse | leap | 15.2 | <built-in method update of dict object at 0x72a9cd08f500> | Operating System |
| canonical | ubuntu_linux | 14.04 | <built-in method update of dict object at 0x72a9997796c0> | Operating System |
| canonical | ubuntu_linux | 16.04 | <built-in method update of dict object at 0x72a963c6bcc0> | Operating System |
| canonical | ubuntu_linux | 18.04 | <built-in method update of dict object at 0x72a963c6ae40> | Operating System |
| canonical | ubuntu_linux | 20.04 | <built-in method update of dict object at 0x72a9cd08c340> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:redhat:enterprise_linux_atomic_host:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:suse:suse_linux_enterprise_server:11:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:suse:suse_linux_enterprise_server:15:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* |