6.4
Moyenne
CVE-2020-15705 GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed
Description
GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| grub2 in Ubuntu 2.04 | premières → < 2.04-1ubuntu26.1 | 2.04-1ubuntu26.1 |
| grub2 in Ubuntu 2.02 | premières → < 2.02-2ubuntu8.16 | 2.02-2ubuntu8.16 |
Références
- www.eclypsium.com www.eclypsium.com
- wiki.ubuntu.com wiki.ubuntu.com
- ubuntu.com ubuntu.com
- www.debian.org www.debian.org
- portal.msrc.microsoft.com portal.msrc.microsoft.com
- access.redhat.com access.redhat.com
- www.suse.com www.suse.com
- www.suse.com www.suse.com
- www.openwall.com www.openwall.com
- lists.gnu.org lists.gnu.org
- [oss-security] 20200729 multiple secure boot grub2 and linux kernel vulnerabilities www.openwall.com
- security.netapp.com security.netapp.com
- USN-4432-1 usn.ubuntu.com
- openSUSE-SU-2020:1280 lists.opensuse.org
- openSUSE-SU-2020:1282 lists.opensuse.org
- [oss-security] 20210302 Multiple GRUB2 vulnerabilities www.openwall.com
- GLSA-202104-05 security.gentoo.org
- [oss-security] 20210916 Containers-optimized OS (COS) membership in the linux-distros list www.openwall.com
- [oss-security] 20210917 Re: Containers-optimized OS (COS) membership in the linux-distros list www.openwall.com
- [oss-security] 20210920 Re: Containers-optimized OS (COS) membership in the linux-distros list www.openwall.com
Chronologie
- Publiée
- Dernière modification