CVE-2020-15707
published 2020-07-29CVE-2020-15707: Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and…
PriorityP434medium6.4CVSS 3.1
AVLACHPRHUINSUCHIHAH
EPSS
1.59%
72.9th percentile
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | grub2 | < grub2 2.04-9 (bookworm) | grub2 2.04-9 (bookworm) |
| gnu | grub2 | <= 2.04 | — |
| gnu | grub2 | >= 0 < 2.04-9 | 2.04-9 |
| gnu | grub2 | >= 0 < 2.04-9 | 2.04-9 |
| gnu | grub2 | >= 0 < 2.04-9 | 2.04-9 |
| gnu | grub2 | >= 0 < 2.04-9 | 2.04-9 |
| gnu | grub2 | >= 0 < 2.02~beta2-36ubuntu3.26 | 2.02~beta2-36ubuntu3.26 |
| gnu | grub2 | >= 0 < 2.02~beta2-36ubuntu3.27 | 2.02~beta2-36ubuntu3.27 |
| gnu | grub2 | >= 0 < 2.02-2ubuntu8.16 | 2.02-2ubuntu8.16 |
| gnu | grub2 | >= 0 < 2.02-2ubuntu8.17 | 2.02-2ubuntu8.17 |
| gnu | grub2 | >= 0 < 2.04-1ubuntu26.1 | 2.04-1ubuntu26.1 |
| gnu | grub2 | >= 0 < 2.04-1ubuntu26.2 | 2.04-1ubuntu26.2 |
| gnu | grub2 | >= 0 < 2.02~beta2-9ubuntu1.20 | 2.02~beta2-9ubuntu1.20 |
| gnu | grub2 | >= 0 < 2.02~beta2-9ubuntu1.21 | 2.02~beta2-9ubuntu1.21 |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
CVSS provenance
nvdv3.16.4MEDIUMCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
osv8.2HIGH
vendor_ubuntu8.2HIGH
vendor_msrc6.4MEDIUM
vendor_debian5.7MEDIUM
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Hitachi Energy APM Edge (Update A)
cisa_ics·2021-12-02·CVSS 9.1
[CRITICAL] Hitachi Energy APM Edge (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Hitachi Energy APM Edge (Update A)
Last RevisedOctober 18, 2022
Alert CodeICSA-21-336-06
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.2
- ATTENTION: Low attack complexity
- Vendor: Hitachi Energy
- Equipment: Transformer Asset Performance Management (APM) Edge
- Vulnerability: Reliance on Uncontrolled Component
## 2. UPDATE OR REPOSTED INFORMATION
This updated advisory is a follow-up to the original advisory titled “ICSA-21-336-06 Hitachi Energy APM Edge” that was published December 02, 2021, on the ICS webpage on cisa.gov/ics.
## 3. RISK EVALUATION
Successful exploitation of thi
Palo Alto
PAN
vendor_paloalto·2020-08-12·CVSS 8.2
CVE-2020-10713 [HIGH] CWE-120 PAN
PAN
Palo Alto Networks is aware of the vulnerability known as BootHole (CVE-2020-10713) that affects the Grand Unified Bootloader (GRUB) used in Palo Alto Networks PAN-OS software. BootHole is a buffer overflow vulnerability that occurs in GRUB2 when parsing an attacker-controlled grub.cfg file. This vulnerability enables arbitrary code execution within the boot environment, which allows persistent control of the system. It is not possible for malicious actors or PAN-OS administrators to exploit this vulnerability under normal conditions. Administrators do not have access to the grub configuration file nor do they have permission to modify it. An attacker would need to first compromise the system and then get the root Linux privileges necessary to perform these actions before they could e
Ubuntu
GRUB2 regression
vendor_ubuntu·2020-08-04·CVSS 8.2
[HIGH] GRUB2 regression
Title: GRUB2 regression
Summary: USN-4432-1 introduced a regression in the GRUB2 bootloader.
USN-4432-1 fixed vulnerabilities in GRUB2 affecting Secure Boot
environments. Unfortunately, the update introduced regressions for
some BIOS systems (either pre-UEFI or UEFI configured in Legacy mode),
preventing them from successfully booting. This update addresses
the issue.
Users with BIOS systems that installed GRUB2 versions from USN-4432-1
should verify that their GRUB2 installation has a correct understanding
of their boot device location and installed the boot loader correctly.
We apologize for the inconvenience.
Original advisory details:
Jesse Michael and Mickey Shkatov discovered that the configuration parser
in GRUB2 did not properly exit when errors were discovered, resulting in
Red Hat
grub2: Integer overflow in initrd size handling
vendor_redhat·2020-07-29·CVSS 5.7
CVE-2020-15707 [MEDIUM] CWE-190 grub2: Integer overflow in initrd size handling
grub2: Integer overflow in initrd size handling
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.
Statement: There's no mitigation available other than installing the update packages.
Ubuntu
GRUB 2 vulnerabilities
vendor_ubuntu·2020-07-29·CVSS 8.2
CVE-2020-14309 [HIGH] GRUB 2 vulnerabilities
Title: GRUB 2 vulnerabilities
Summary: Several security issues were fixed in GRUB 2.
Jesse Michael and Mickey Shkatov discovered that the configuration parser
in GRUB2 did not properly exit when errors were discovered, resulting in
heap-based buffer overflows. A local attacker could use this to execute
arbitrary code and bypass UEFI Secure Boot restrictions. (CVE-2020-10713)
Chris Coulson discovered that the GRUB2 function handling code did not
properly handle a function being redefined, leading to a use-after-free
vulnerability. A local attacker could use this to execute arbitrary code
and bypass UEFI Secure Boot restrictions. (CVE-2020-15706)
Chris Coulson discovered that multiple integer overflows existed in GRUB2
when handling certain filesystems or font files, leading to heap-base
Microsoft
GRUB2 contained integer overflows when handling the initrd command leading to a heap-based buffer overflow.
vendor_msrc·2020-07-14·CVSS 6.4
CVE-2020-15707 [MEDIUM] CWE-362 GRUB2 contained integer overflows when handling the initrd command leading to a heap-based buffer overflow.
GRUB2 contained integer overflows when handling the initrd command leading to a heap-based buffer overflow.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
canonical: canonical
Customer Action Required: Yes
Debian
CVE-2020-15707: grub2 - Integer overflows were discovered in the functions grub_cmd_initrd and grub_init...
vendor_debian·2020·CVSS 5.7
CVE-2020-15707 [MEDIUM] CVE-2020-15707: grub2 - Integer overflows were discovered in the functions grub_cmd_initrd and grub_init...
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.
Scope: local
bookworm: resolved (fixed in 2.04-9)
bullseye: resolved (fixed in 2.04-9)
forky: resolved (fixed in 2.04-9)
sid: resolved (fixed in 2.04-9)
trixie: resolved (fixed in 2.04-9)
GHSA
GHSA-mf72-cf87-p3p2: Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red
ghsa_unreviewed·2022-05-24
CVE-2020-15707 [MEDIUM] CWE-362 GHSA-mf72-cf87-p3p2: Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.
OSV
grub2, grub2-signed regression
osv·2020-08-04·CVSS 8.2
[HIGH] grub2, grub2-signed regression
grub2, grub2-signed regression
USN-4432-1 fixed vulnerabilities in GRUB2 affecting Secure Boot
environments. Unfortunately, the update introduced regressions for
some BIOS systems (either pre-UEFI or UEFI configured in Legacy mode),
preventing them from successfully booting. This update addresses
the issue.
Users with BIOS systems that installed GRUB2 versions from USN-4432-1
should verify that their GRUB2 installation has a correct understanding
of their boot device location and installed the boot loader correctly.
We apologize for the inconvenience.
Original advisory details:
Jesse Michael and Mickey Shkatov discovered that the configuration parser
in GRUB2 did not properly exit when errors were discovered, resulting in
heap-based buffer overflows. A local attacker could use this to
OSV
grub2, grub2-signed vulnerabilities
osv·2020-07-29·CVSS 8.2
CVE-2020-10713 [HIGH] grub2, grub2-signed vulnerabilities
grub2, grub2-signed vulnerabilities
Jesse Michael and Mickey Shkatov discovered that the configuration parser
in GRUB2 did not properly exit when errors were discovered, resulting in
heap-based buffer overflows. A local attacker could use this to execute
arbitrary code and bypass UEFI Secure Boot restrictions. (CVE-2020-10713)
Chris Coulson discovered that the GRUB2 function handling code did not
properly handle a function being redefined, leading to a use-after-free
vulnerability. A local attacker could use this to execute arbitrary code
and bypass UEFI Secure Boot restrictions. (CVE-2020-15706)
Chris Coulson discovered that multiple integer overflows existed in GRUB2
when handling certain filesystems or font files, leading to heap-based
buffer overflows. A local attacker could use the
OSV
CVE-2020-15707: Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red
osv·2020-07-29·CVSS 6.4
CVE-2020-15707 [MEDIUM] CVE-2020-15707: Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.
No detection rules found.
No public exploits indexed.
Qualys
GRUB2 Boothole Buffer Overflow Vulnerability (CVE-2020-10713) - Automatically Discover, Prioritize and Remediate Using Qualys VMDR® | Qualys
blogs_qualys·2020-08-03·CVSS 8.2
CVE-2020-10713 [HIGH] GRUB2 Boothole Buffer Overflow Vulnerability (CVE-2020-10713) - Automatically Discover, Prioritize and Remediate Using Qualys VMDR® | Qualys
On July 29, 2020, Eclypsium researchers disclosed a high-risk vulnerability in GRUB2 (GRand Unified Bootloader version 2) affecting billions of Linux and Windows systems, even when secure boot is enabled. CVE-2020-10713 is assigned to this buffer overflow vulnerability, termed as “Boothole”.
Successful exploitation of the vulnerability requires high privileges or physical access to the device. According to Eclypsium researchers, “attackers exploiting this vulnerability can install persistent and stealthy bootkits or malicious bootloaders that could give them near-total control over the victim device.”
Secure Boot is designed to verify all the firmware of the computer is trusted. However, CVE-2020-10713 results in total pwn of secure boot in systems using GRUB. The bug resides in GRUB’s i
Qualys
GRUB2 Boothole Buffer Overflow Vulnerability (CVE-2020-10713) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR®
blogs_qualys·2020-08-03·CVSS 8.2
CVE-2020-10713 [HIGH] GRUB2 Boothole Buffer Overflow Vulnerability (CVE-2020-10713) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR®
On July 29, 2020, Eclypsium researchers disclosed a high-risk vulnerability in GRUB2 (GRand Unified Bootloader version 2) affecting billions of Linux and Windows systems, even when secure boot is enabled. CVE-2020-10713 is assigned to this buffer overflow vulnerability, termed as “Boothole”.
Successful exploitation of the vulnerability requires high privileges or physical access to the device. According to Eclypsium researchers , “attackers exploiting this vulnerability can install persistent and stealthy bootkits or malicious bootloaders that could give them near-total control over the victim device.”
Secure Boot is designed to verify all the firmware of the computer is trusted. However, CVE-2020-10713 results in total pwn of secure boot in systems using GRUB. The bug resides in GRUB’s
Tenable
CVE-2020-10713: “BootHole” GRUB2 Bootloader Arbitrary Code Execution Vulnerability
blogs_tenable·2020-07-29·CVSS 8.2
[HIGH] CVE-2020-10713: “BootHole” GRUB2 Bootloader Arbitrary Code Execution Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2020-15707 grub2: Integer overflow in initrd size handling [fedora-all]
bugzilla·2020-08-03·CVSS 5.7
CVE-2020-15707 [MEDIUM] CVE-2020-15707 grub2: Integer overflow in initrd size handling [fedora-all]
CVE-2020-15707 grub2: Integer overflow in initrd size handling [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions o
Bugzilla
CVE-2020-15707 grub2: Integer overflow in initrd size handling
bugzilla·2020-07-29·CVSS 5.7
CVE-2020-15707 [MEDIUM] CVE-2020-15707 grub2: Integer overflow in initrd size handling
CVE-2020-15707 grub2: Integer overflow in initrd size handling
There are a few integer overflows in grub2 while handling several sizes related to initrd information.
These could be triggered by a crafted filesystem with very large files.
Discussion:
There's an issue on current grub version caused by a integer overflow at grub_cmd_initrd() function. When having extremely large files, the size file variable used for calculation may overflow, allowing an attacker to cause further invalid memory accesses causing memory corruption and integrity issues.
---
Acknowledgments:
Name: Colin Watson (Debian / Canonical Ltd.), Chris Coulson (Canonical)
---
Statement:
There's no mitigation available other than installing the update packages.
---
This issue has been addressed in the following p
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.htmlhttp://ubuntu.com/security/notices/USN-4432-1http://www.openwall.com/lists/oss-security/2020/07/29/3https://access.redhat.com/security/vulnerabilities/grub2bootloaderhttps://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011https://security.gentoo.org/glsa/202104-05https://security.netapp.com/advisory/ntap-20200731-0008/https://usn.ubuntu.com/4432-1/https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypasshttps://www.debian.org/security/2020-GRUB-UEFI-SecureBoothttps://www.debian.org/security/2020/dsa-4735https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/https://www.openwall.com/lists/oss-security/2020/07/29/3https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/https://www.suse.com/support/kb/doc/?id=000019673http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.htmlhttp://ubuntu.com/security/notices/USN-4432-1http://www.openwall.com/lists/oss-security/2020/07/29/3https://access.redhat.com/security/vulnerabilities/grub2bootloaderhttps://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011https://security.gentoo.org/glsa/202104-05https://security.netapp.com/advisory/ntap-20200731-0008/https://usn.ubuntu.com/4432-1/https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypasshttps://www.debian.org/security/2020-GRUB-UEFI-SecureBoothttps://www.debian.org/security/2020/dsa-4735https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/https://www.openwall.com/lists/oss-security/2020/07/29/3https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/https://www.suse.com/support/kb/doc/?id=000019673
2020-07-29
Published