grub2 Config File Parser grub.cfg BootHole buffer overflow

Summaryinfo

A vulnerability was found in grub2. It has been classified as critical. The affected element is an unknown function of the file grub.cfg of the component Config File Parser. The manipulation leads to buffer overflow (BootHole). This vulnerability is listed as CVE-2020-10713. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in grub2 (unknown version) and classified as critical. This issue affects an unknown code block of the file grub.cfg of the component Config File Parser. The manipulation with an unknown input leads to a buffer overflow vulnerability (BootHole). Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

The weakness was presented 07/29/2020 with Eclypsium as confirmed blog post (Website). It is possible to read the advisory at eclypsium.com. The public release was coordinated in cooperation with the project team. The identification of this vulnerability is CVE-2020-10713. Attacking locally is a requirement. Additional levels of successful authentication are necessary for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The advisory points out:

Eclypsium researchers have discovered a vulnerability — dubbed “BootHole” — in the GRUB2 bootloader utilized by most Linux systems that can be used to gain arbitrary code execution during the boot process, even when Secure Boot is enabled.

The vulnerability scanner Nessus provides a plugin with the ID 236732 (Alibaba Cloud Linux 3 : 0048: fwupd (ALINUX3-SA-2021:0048)), which helps to determine the existence of the flaw in a target environment. The advisory illustrates:

Rather than halting execution or exiting, it just prints an error to the console and returns to the calling function. Unfortunately, the flex code has been written with the expectation that any calls to YY_FATAL_ERROR() will never return. This results in yy_flex_strncpy() being called and copying the source string from the configuration file into a buffer that is too small to contain it.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (236732) and CERT Bund (WID-SEC-2022-0553). portal.msrc.microsoft.com is providing further details. Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Ubuntu Linux
• IBM Security Guardium
• Open Source Grub
• Debian Linux
• Red Hat Enterprise Linux
• Microsoft Windows
• Cisco Identity Services Engine (ISE)
• SUSE Linux
• Cisco Router
• Oracle Linux
• HPE ProLiant
• Gentoo Linux
• Palo Alto Networks PAN-OS
• Avaya Aura Communication Manager
• Avaya Aura Session Manager
• Avaya Aura Application Enablement Services
• Avaya Aura System Manager
• Avaya Web License Manager
• Aruba ArubaOS

Productinfo

Name

• grub2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #182: GRUB2: crafted grub.cfg file can lead to arbitrary code execution during boot process (by misc)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion