CVSS: 6.0EPSS: 0%CPEs: 13EXPL: 0CVE-2020-14310 – grub2: Integer overflow read_section_as_string may lead to heap-based buffer overflow
https://notcve.org/view.php?id=CVE-2020-14310
There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow. Se presenta un problema en grub2 versiones anteriores a 2.06, en la función read_section_as_string(). Se espera que el nombre de la fuente sea una longitud máxima UINT32_MAX - 1 en bytes, pero no lo verifica antes de proceder con la asignación del búfer para leer el valor desde el valor de la fuente. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14310 https://security.gentoo.org/glsa/202104-05 https://usn.ubuntu.com/4432-1 https://access.redhat.com/security/cve/CVE-2020-14310 https://bugzilla.redhat.com/show_bug.cgi?id=1852030 • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2019-14865 – grub2: grub2-set-bootflag utility causes grubenv corruption rendering the system non-bootable
https://notcve.org/view.php?id=CVE-2019-14865
A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots. Se encontró un fallo en la utilidad grub2-set-bootflag de grub2. Un atacante local podría ejecutar esta utilidad bajo la presión de recursos (por ejemplo, configurando RLIMIT), causando que archivos de configuración de grub2 sean truncados y dejando el sistema no reiniciable en los reinicios posteriores. A flaw was found in the grub2-set-bootflag utility of grub2. • http://www.openwall.com/lists/oss-security/2024/02/06/3 https://access.redhat.com/errata/RHSA-2020:0335 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14865 https://seclists.org/oss-sec/2019/q4/101 https://access.redhat.com/security/cve/CVE-2019-14865 https://bugzilla.redhat.com/show_bug.cgi?id=1764925 • CWE-267: Privilege Defined With Unsafe Actions •
CVSS: 7.4EPSS: 0%CPEs: 6EXPL: 1CVE-2015-8370 – grub2: buffer overflow when checking password entered during bootup
https://notcve.org/view.php?id=CVE-2015-8370
Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error. Múltiple desbordamiento inferior de entero en Grub2 1.98 hasta la versión 2.02 permite a atacantes físicamente próximos eludir la autenticación, obtener información sensible o causar una denegación de servicio (corrupción de disco) a través del carácter backspace en la función (1) grub_username_get en grub-core/normal/auth.c o (2) grub_password_get en lib/crypto.c, lo que desencadena un error de memoria 'Off-by-two' o 'Out of bounds overwrite'. A flaw was found in the way grub2 handled backspace characters entered in username and password prompts. An attacker with access to the system console could use this flaw to bypass grub2 password protection and gain administrative access to the system. • http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173703.html http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174049.html http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00037.html http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00039.html http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00040.html http://lists.opensuse.org/opensuse-security-announce/2 • CWE-191: Integer Underflow (Wrap or Wraparound) CWE-264: Permissions, Privileges, and Access Controls CWE-787: Out-of-bounds Write •