Log in Start free

Vulnerability · Published Mar 3, 2021 · Assigned by redhat

CVE-2020-25632

High 8.2

In plain English

A high-severity use-after-free in grub2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.2High
Exploit odds (30 days)1.2%top 32.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8shim-aa6415.4-2.el8_1.almaALSA-2021:1734
AlmaLinux:8shim-ia3215.4-2.el8_1.almaALSA-2021:1734
AlmaLinux:8shim-unsigned-aarch6415-7.el8_1.almaALSA-2021:1734
AlmaLinux:8shim-unsigned-x6415.4-4.el8_1.almaALSA-2021:1734
AlmaLinux:8shim-x6415.4-2.el8_1.almaALSA-2021:1734
Alpine:v3.20grub2.06-r0ALPINE-CVE-2020-25632
Alpine:v3.21grub2.06-r0ALPINE-CVE-2020-25632
Alpine:v3.22grub2.06-r0ALPINE-CVE-2020-25632
Alpine:v3.23grub2.06-r0ALPINE-CVE-2020-25632
Alpine:v3.24grub2.06-r0ALPINE-CVE-2020-25632
Debian:12grub22.04-16DEBIAN-CVE-2020-25632
Debian:13grub22.04-16DEBIAN-CVE-2020-25632
Debian:14grub22.04-16DEBIAN-CVE-2020-25632
Rocky Linux:8fwupd0:1.5.9-1.el8_4RLSA-2021:2566
Rocky Linux:8shim-unsigned-aarch640:15-7.el8.1.1RLSA-2021:1734

Affected products (as reported)

VendorProductVersions
n/a grub2 grub 2.06

Weakness: CWE-416

References