admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-08-04 08:44:25 +00:00
Code Issues Packages Projects Releases Wiki Activity
cvelist/2020/15xxx/CVE-2020-15705.json
CVE Team f7055a77c0
"-Synchronized-Data."
2021-09-21 12:01:06 +00:00

208 lines
8.5 KiB
JSON
Raw Blame History

{
"CVE_data_meta": {
"ASSIGNER": "security@ubuntu.com",
"DATE_PUBLIC": "2020-07-29T17:00:00.000Z",
"ID": "CVE-2020-15705",
"STATE": "PUBLIC",
"TITLE": "GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "grub2 in Ubuntu",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "20.04 LTS",
"version_value": "2.04-1ubuntu26.1"
},
{
"version_affected": "<",
"version_name": "18.04 LTS",
"version_value": "2.02-2ubuntu8.16"
},
{
"version_affected": "<",
"version_name": "16.04 LTS",
"version_value": "2.02~beta2-36ubuntu3.26"
},
{
"version_affected": "<",
"version_name": "14.04 ESM",
"version_value": "2.02~beta2-9ubuntu1.20"
}
]
}
}
]
},
"vendor_name": "Ubuntu"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Mathieu Trudel-Lapierre"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-347 Improper Verification of Cryptographic Signature"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/",
"refsource": "CONFIRM",
"url": "https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/"
},
{
"name": "https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass",
"refsource": "UBUNTU",
"url": "https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass"
},
{
"name": "http://ubuntu.com/security/notices/USN-4432-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/security/notices/USN-4432-1"
},
{
"name": "https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot"
},
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011",
"refsource": "CONFIRM",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011"
},
{
"name": "https://access.redhat.com/security/vulnerabilities/grub2bootloader",
"refsource": "REDHAT",
"url": "https://access.redhat.com/security/vulnerabilities/grub2bootloader"
},
{
"name": "https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/",
"refsource": "SUSE",
"url": "https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/"
},
{
"name": "https://www.suse.com/support/kb/doc/?id=000019673",
"refsource": "SUSE",
"url": "https://www.suse.com/support/kb/doc/?id=000019673"
},
{
"name": "https://www.openwall.com/lists/oss-security/2020/07/29/3",
"refsource": "CONFIRM",
"url": "https://www.openwall.com/lists/oss-security/2020/07/29/3"
},
{
"name": "https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html",
"refsource": "CONFIRM",
"url": "https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html"
},
{
"refsource": "MLIST",
"name": "[oss-security] 20200729 multiple secure boot grub2 and linux kernel vulnerabilities",
"url": "http://www.openwall.com/lists/oss-security/2020/07/29/3"
},
{
"refsource": "CONFIRM",
"name": "https://security.netapp.com/advisory/ntap-20200731-0008/",
"url": "https://security.netapp.com/advisory/ntap-20200731-0008/"
},
{
"refsource": "UBUNTU",
"name": "USN-4432-1",
"url": "https://usn.ubuntu.com/4432-1/"
},
{
"refsource": "SUSE",
"name": "openSUSE-SU-2020:1280",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00067.html"
},
{
"refsource": "SUSE",
"name": "openSUSE-SU-2020:1282",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00069.html"
},
{
"refsource": "MLIST",
"name": "[oss-security] 20210302 Multiple GRUB2 vulnerabilities",
"url": "http://www.openwall.com/lists/oss-security/2021/03/02/3"
},
{
"refsource": "GENTOO",
"name": "GLSA-202104-05",
"url": "https://security.gentoo.org/glsa/202104-05"
},
{
"refsource": "MLIST",
"name": "[oss-security] 20210916 Containers-optimized OS (COS) membership in the linux-distros list",
"url": "http://www.openwall.com/lists/oss-security/2021/09/17/2"
},
{
"refsource": "MLIST",
"name": "[oss-security] 20210917 Re: Containers-optimized OS (COS) membership in the linux-distros list",
"url": "http://www.openwall.com/lists/oss-security/2021/09/17/4"
},
{
"refsource": "MLIST",
"name": "[oss-security] 20210920 Re: Containers-optimized OS (COS) membership in the linux-distros list",
"url": "http://www.openwall.com/lists/oss-security/2021/09/21/1"
}
]
},
"source": {
"advisory": "USN 4432-1",
"defect": [
"https://launchpad.net/bugs/1801968"
],
"discovery": "INTERNAL"
}
}
Reference in New Issue View Git Blame Copy Permalink