grub2 up to 2.05 read_section_as_string Font File heap-based overflow

Summaryinfo

A vulnerability categorized as critical has been discovered in grub2 up to 2.05. This affects the function read_section_as_string. Executing a manipulation as part of Font File can lead to heap-based overflow. The identification of this vulnerability is CVE-2020-14310. The attack can only be executed locally. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in grub2 up to 2.05. It has been declared as critical. This vulnerability affects the function read_section_as_string. The manipulation as part of a Font File leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow.

The weakness was shared 07/31/2020 as not defined bug report (Bugzilla). The advisory is shared for download at bugzilla.redhat.com. This vulnerability was named CVE-2020-14310 since 06/17/2020. The attack needs to be approached locally. Additional levels of successful authentication are needed for exploitation. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 236631 (Alibaba Cloud Linux 3 : 0026: grub2 (ALINUX3-SA-2021:0026)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.06 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (236631) and CERT Bund (WID-SEC-2022-0553). The entry VDB-159245 is related to this item. Once again VulDB remains the best source for vulnerability data.

Affected

• Ubuntu Linux
• IBM Security Guardium
• Open Source Grub
• Debian Linux
• Red Hat Enterprise Linux
• Microsoft Windows
• Cisco Identity Services Engine (ISE)
• SUSE Linux
• Cisco Router
• Oracle Linux
• HPE ProLiant
• Gentoo Linux
• Palo Alto Networks PAN-OS
• Avaya Aura Communication Manager
• Avaya Aura Session Manager
• Avaya Aura Application Enablement Services
• Avaya Aura System Manager
• Avaya Web License Manager
• Aruba ArubaOS

Productinfo

Name

• grub2

Version

• 2.05

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion