Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Title GRUB2 bootloader is vulnerable to buffer overflow
Name VU#174059 First vendor Publication 2020-07-29
Vendor VU-CERT Last vendor Modification 2020-08-13
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Overall CVSS Score 8.2
Base Score 8.2 Environmental Score 8.2
impact SubScore 6 Temporal Score 8.2
Exploitabality Sub Score 1.5
Attack Vector Local Attack Complexity Low
Privileges Required High User Interaction None
Scope Changed Confidentiality Impact High
Integrity Impact High Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 4.6 Attack Range Local
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores



The GRUB2 boot loader is vulnerable to buffer overflow, which results in arbitrary code execution during the boot process, even when Secure Boot is enabled.


GRUB2 is a multiboot boot loader that replaced GRUB Legacy in 2012. A boot loader is the first program that runs upon boot and loads the operating system. Many vendors also use a shim, a signed software package that contains the vendor?s certificate and code that verifies and runs the boot loader. This means that firmware Certificate Authority providers can just sign the shim as opposed to all of the other supported programs.

GRUB2 is vulnerable to a buffer overflow when parsing content from the GRUB2 configuration file (grub.cfg). This configuration file is an external file commonly located in the EFI System Partition and can therefore be modified by an attacker with administrator privileges without altering the integrity of the signed vendor shim and GRUB2 boot loader executables. This could allow an authenticated, local attacker to modify the contents of the GRUB2 configuration file to ensure that the attacker's chosen code is run before the operating system is loaded. This could allow the attacker to gain persistence on the device, even with Secure Boot enabled. All versions of GRUB2 that load commands from an external grub.cfg configuration file are vulnerable.


An authenticated, local attacker could modify the contents of the GRUB2 configuration file to execute arbitrary code that bypasses signature verification. This could allow the attacker to gain persistence on the device, even with Secure Boot enabled. Because the attacker's code runs before the operating system, the attacker could control how the operating system is loaded, directly patch the operating system, or even direct the bootloader to alternate OS images. All versions of GRUB2 that load commands from an external grub.cfg configuration file are vulnerable.


Apply an update if operationally feasible

Update GRUB2 to the latest version to address this vulnerability when operationally feasible. Some patches were originally reported to leave systems unbootable so users are encouraged to review and test patches prior to implementing them. Linux distributions and other vendors using GRUB2 will need to update their installers, boot loaders, and shims. New shims will need to be signed by the Microsoft 3rd Party UEFI Certificate Authority. Administrators of affected devices will need to update installed versions of operating systems as well as installer images, including disaster recovery media. Until all affected versions are added to the dbx revocation list, an attacker would be able to use a vulnerable version of shim and GRUB2. Eventually the UEFI revocation list (dbx) needs to be updated in the firmware of each affected system to prevent running this vulnerable code during boot.


Thanks to Mickey Shkatov and Jesse Michael from Eclypsium for reporting this vulnerability.

This document was written by Madison Oliver.

Original Source

Url : https://kb.cert.org/vuls/id/174059

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

Application 7

Snort® IPS/IDS

Date Description
2020-09-15 Grub malicious grub.cfg download attempt
RuleID : 54757 - Revision : 1 - Type : FILE-OTHER
2020-09-15 Grub malicious grub.cfg download attempt
RuleID : 54756 - Revision : 1 - Type : FILE-OTHER

Alert History

If you want to see full details history, please login or register.
Date Informations
2020-08-13 21:17:41
  • Multiple Updates
2020-08-05 21:28:55
  • Multiple Updates
2020-07-31 21:17:37
  • Multiple Updates
2020-07-30 21:28:49
  • Multiple Updates
2020-07-30 21:17:40
  • Multiple Updates
2020-07-30 17:28:31
  • Multiple Updates
2020-07-30 17:17:28
  • Multiple Updates
2020-07-29 21:17:42
  • First insertion