CVE-2020-25632
Severity
8.2HIGH
EPSS
0.0%
top 93.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 3
Latest updateMay 24
Description
A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 1.5 | Impact: 6.0
Affected Packages6 packages
Also affects: Fedora 33, 34, Enterprise Linux 7.0, 8.0, 7.2, 7.3, 7.4, 7.6, 7.7, 8.2, 8.1
Patches
🔴Vulnerability Details
4📋Vendor Advisories
4Microsoft▶
A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leadi↗2021-03-09
Debian▶
CVE-2020-25632: grub2 - A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation al...↗2020