CVE-2020-14308

grub2: grub_malloc does not validate allocation size allowing for arithmetic overflow and subsequent heap-based buffer overflow

Severity Score

6.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process.

En grub2 versiones anteriores a 2.06, el asignador de memoria grub no comprueba posibles desbordamientos aritméticos en el tamaño de asignación solicitada. Esto conlleva a la función a devolver asignaciones de memoria no válidas que puedan ser usadas para causar posibles impactos de integridad, confidencialidad y disponibilidad durante el proceso de arranque

A flaw was found in current grub2 versions as shipped with Red Hat Enterprise Linux 7 and 8, where the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This issue leads the function to return invalid memory allocations, causing heap-based overflows in several code paths. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.

*Credits: N/A

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-06-17 CVE Reserved
2020-07-28 CVE Published
2023-03-08 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-122: Heap-based Buffer Overflow
CWE-190: Integer Overflow or Wraparound

CAPEC

References (11)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2020/07/29/3	Mailing List
http://www.openwall.com/lists/oss-security/2021/09/17/2	Mailing List
http://www.openwall.com/lists/oss-security/2021/09/17/4	Mailing List
http://www.openwall.com/lists/oss-security/2021/09/21/1	Mailing List
https://security.netapp.com/advisory/ntap-20200731-0008	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html	2022-04-18
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html	2022-04-18
https://bugzilla.redhat.com/show_bug.cgi?id=1852009	2020-08-03
https://security.gentoo.org/glsa/202104-05	2022-04-18
https://usn.ubuntu.com/4432-1	2022-04-18
https://access.redhat.com/security/cve/CVE-2020-14308	2020-08-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gnu Search vendor "Gnu"		Grub2 Search vendor "Gnu" for product "Grub2"				< 2.06 Search vendor "Gnu" for product "Grub2" and version " < 2.06"		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				15.1 Search vendor "Opensuse" for product "Leap" and version "15.1"		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				15.2 Search vendor "Opensuse" for product "Leap" and version "15.2"		-		Affected