CVE-2020-25632

CWE-416Use After Free10 documents9 sources
Severity
8.2HIGH
EPSS
0.0%
top 93.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 3
Latest updateMay 24

Description

A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 1.5 | Impact: 6.0

Affected Packages6 packages

NVDgnu/grub2< 2.06
Debiangrub2< 2.04-16+3
Ubuntugrub2-signed< 1.167~18.04.5+1
Ubuntugrub2-unsigned< 2.04-1ubuntu44.1.2+1
CVEListV5grub2grub 2.06

Also affects: Fedora 33, 34, Enterprise Linux 7.0, 8.0, 7.2, 7.3, 7.4, 7.6, 7.7, 8.2, 8.1

Patches

🔴Vulnerability Details

4
GHSA
GHSA-r6r2-gvcm-979j: A flaw was found in grub2 in versions prior to 22022-05-24
OSV
grub2-signed, grub2-unsigned vulnerabilities2021-06-18
CVEList
CVE-2020-25632: A flaw was found in grub2 in versions prior to 22021-03-03
OSV
CVE-2020-25632: A flaw was found in grub2 in versions prior to 22021-03-03

📋Vendor Advisories

4
Ubuntu
GRUB 2 vulnerabilities2021-06-18
Microsoft
A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leadi2021-03-09
Red Hat
grub2: Use-after-free in rmmod command2021-03-02
Debian
CVE-2020-25632: grub2 - A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation al...2020

💬Community

1
Bugzilla
CVE-2020-25632 grub2: Use-after-free in rmmod command2020-09-16