// For flags

CVE-2015-8370

grub2: buffer overflow when checking password entered during bootup

Severity Score

7.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.

Múltiple desbordamiento inferior de entero en Grub2 1.98 hasta la versión 2.02 permite a atacantes físicamente próximos eludir la autenticación, obtener información sensible o causar una denegación de servicio (corrupción de disco) a través del carácter backspace en la función (1) grub_username_get en grub-core/normal/auth.c o (2) grub_password_get en lib/crypto.c, lo que desencadena un error de memoria 'Off-by-two' o 'Out of bounds overwrite'.

A flaw was found in the way grub2 handled backspace characters entered in username and password prompts. An attacker with access to the system console could use this flaw to bypass grub2 password protection and gain administrative access to the system.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2015-11-27 CVE Reserved
  • 2015-12-15 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-10-21 CVE Updated
  • 2024-10-21 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-191: Integer Underflow (Wrap or Wraparound)
  • CWE-264: Permissions, Privileges, and Access Controls
  • CWE-787: Out-of-bounds Write
CAPEC
References (25)
URL Tag Source
http://packetstormsecurity.com/files/134831/Grub2-Authentication-Bypass.html
http://seclists.org/fulldisclosure/2015/Dec/69 Mailing List
http://www.openwall.com/lists/oss-security/2015/12/15/6 Mailing List
http://www.openwall.com/lists/oss-security/2024/01/15/3 Mailing List
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/archive/1/537115/100/0/threaded Mailing List
http://www.securityfocus.com/bid/79358 Vdb Entry
http://www.securitytracker.com/id/1034422 Vdb Entry
URL Date SRC
http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html 2024-10-21
URL Date SRC
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html 2024-01-16
URL Date SRC
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173703.html 2024-01-16
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174049.html 2024-01-16
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00037.html 2024-01-16
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00039.html 2024-01-16
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00040.html 2024-01-16
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00041.html 2024-01-16
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00043.html 2024-01-16
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00044.html 2024-01-16
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00003.html 2024-01-16
http://rhn.redhat.com/errata/RHSA-2015-2623.html 2024-01-16
http://www.debian.org/security/2015/dsa-3421 2024-01-16
http://www.ubuntu.com/usn/USN-2836-1 2024-01-16
https://security.gentoo.org/glsa/201512-03 2024-01-16
https://access.redhat.com/security/cve/CVE-2015-8370 2015-12-15
https://bugzilla.redhat.com/show_bug.cgi?id=1286966 2015-12-15
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Gnu
Search vendor "Gnu"
 Grub2
Search vendor "Gnu" for product "Grub2"
 1.98
Search vendor "Gnu" for product "Grub2" and version "1.98"
-
Affected
Gnu
Search vendor "Gnu"
 Grub2
Search vendor "Gnu" for product "Grub2"
 1.99
Search vendor "Gnu" for product "Grub2" and version "1.99"
-
Affected
Gnu
Search vendor "Gnu"
 Grub2
Search vendor "Gnu" for product "Grub2"
 2.00
Search vendor "Gnu" for product "Grub2" and version "2.00"
-
Affected
Gnu
Search vendor "Gnu"
 Grub2
Search vendor "Gnu" for product "Grub2"
 2.01
Search vendor "Gnu" for product "Grub2" and version "2.01"
-
Affected
Gnu
Search vendor "Gnu"
 Grub2
Search vendor "Gnu" for product "Grub2"
 2.02
Search vendor "Gnu" for product "Grub2" and version "2.02"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
 Fedora
Search vendor "Fedoraproject" for product "Fedora"
 23
Search vendor "Fedoraproject" for product "Fedora" and version "23"
-
Affected