grub2-2.06-7.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10824 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z grub2-2.06-7.1 on GA media These are all security issues fixed in the grub2-2.06-7.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10824 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:10824 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2020-10713/ SUSE CVE CVE-2020-10713 page https://www.suse.com/security/cve/CVE-2020-14308/ SUSE CVE CVE-2020-14308 page https://www.suse.com/security/cve/CVE-2020-15705/ SUSE CVE CVE-2020-15705 page https://www.suse.com/security/cve/CVE-2020-15706/ SUSE CVE CVE-2020-15706 page https://www.suse.com/security/cve/CVE-2020-15707/ SUSE CVE CVE-2020-15707 page https://www.suse.com/security/cve/CVE-2020-25632/ SUSE CVE CVE-2020-25632 page https://www.suse.com/security/cve/CVE-2020-25647/ SUSE CVE CVE-2020-25647 page https://www.suse.com/security/cve/CVE-2020-27749/ SUSE CVE CVE-2020-27749 page https://www.suse.com/security/cve/CVE-2020-27779/ SUSE CVE CVE-2020-27779 page https://www.suse.com/security/cve/CVE-2021-20225/ SUSE CVE CVE-2021-20225 page https://www.suse.com/security/cve/CVE-2021-20233/ SUSE CVE CVE-2021-20233 page openSUSE Tumbleweed grub2-2.06-7.1 grub2-branding-upstream-2.06-7.1 grub2-i386-pc-2.06-7.1 grub2-i386-pc-debug-2.06-7.1 grub2-snapper-plugin-2.06-7.1 grub2-systemd-sleep-plugin-2.06-7.1 grub2-x86_64-efi-2.06-7.1 grub2-x86_64-efi-debug-2.06-7.1 grub2-x86_64-xen-2.06-7.1 grub2-2.06-7.1 as a component of openSUSE Tumbleweed grub2-branding-upstream-2.06-7.1 as a component of openSUSE Tumbleweed grub2-i386-pc-2.06-7.1 as a component of openSUSE Tumbleweed grub2-i386-pc-debug-2.06-7.1 as a component of openSUSE Tumbleweed grub2-snapper-plugin-2.06-7.1 as a component of openSUSE Tumbleweed grub2-systemd-sleep-plugin-2.06-7.1 as a component of openSUSE Tumbleweed grub2-x86_64-efi-2.06-7.1 as a component of openSUSE Tumbleweed grub2-x86_64-efi-debug-2.06-7.1 as a component of openSUSE Tumbleweed grub2-x86_64-xen-2.06-7.1 as a component of openSUSE Tumbleweed A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2020-10713 openSUSE Tumbleweed:grub2-2.06-7.1 openSUSE Tumbleweed:grub2-branding-upstream-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-debug-2.06-7.1 openSUSE Tumbleweed:grub2-snapper-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-systemd-sleep-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-debug-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-xen-2.06-7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-10713.html CVE-2020-10713 https://bugzilla.suse.com/1168994 SUSE Bug 1168994 https://bugzilla.suse.com/1173456 SUSE Bug 1173456 https://bugzilla.suse.com/1173812 SUSE Bug 1173812 https://bugzilla.suse.com/1199353 SUSE Bug 1199353 In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process. CVE-2020-14308 openSUSE Tumbleweed:grub2-2.06-7.1 openSUSE Tumbleweed:grub2-branding-upstream-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-debug-2.06-7.1 openSUSE Tumbleweed:grub2-snapper-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-systemd-sleep-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-debug-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-xen-2.06-7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-14308.html CVE-2020-14308 https://bugzilla.suse.com/1168994 SUSE Bug 1168994 https://bugzilla.suse.com/1173812 SUSE Bug 1173812 GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions. CVE-2020-15705 openSUSE Tumbleweed:grub2-2.06-7.1 openSUSE Tumbleweed:grub2-branding-upstream-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-debug-2.06-7.1 openSUSE Tumbleweed:grub2-snapper-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-systemd-sleep-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-debug-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-xen-2.06-7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-15705.html CVE-2020-15705 https://bugzilla.suse.com/1174421 SUSE Bug 1174421 https://bugzilla.suse.com/1182890 SUSE Bug 1182890 GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions. CVE-2020-15706 openSUSE Tumbleweed:grub2-2.06-7.1 openSUSE Tumbleweed:grub2-branding-upstream-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-debug-2.06-7.1 openSUSE Tumbleweed:grub2-snapper-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-systemd-sleep-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-debug-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-xen-2.06-7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-15706.html CVE-2020-15706 https://bugzilla.suse.com/1174463 SUSE Bug 1174463 Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions. CVE-2020-15707 openSUSE Tumbleweed:grub2-2.06-7.1 openSUSE Tumbleweed:grub2-branding-upstream-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-debug-2.06-7.1 openSUSE Tumbleweed:grub2-snapper-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-systemd-sleep-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-debug-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-xen-2.06-7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-15707.html CVE-2020-15707 https://bugzilla.suse.com/1174570 SUSE Bug 1174570 A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2020-25632 openSUSE Tumbleweed:grub2-2.06-7.1 openSUSE Tumbleweed:grub2-branding-upstream-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-debug-2.06-7.1 openSUSE Tumbleweed:grub2-snapper-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-systemd-sleep-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-debug-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-xen-2.06-7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-25632.html CVE-2020-25632 https://bugzilla.suse.com/1176711 SUSE Bug 1176711 A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2020-25647 openSUSE Tumbleweed:grub2-2.06-7.1 openSUSE Tumbleweed:grub2-branding-upstream-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-debug-2.06-7.1 openSUSE Tumbleweed:grub2-snapper-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-systemd-sleep-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-debug-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-xen-2.06-7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-25647.html CVE-2020-25647 https://bugzilla.suse.com/1177883 SUSE Bug 1177883 A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution which could also circumvent Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2020-27749 openSUSE Tumbleweed:grub2-2.06-7.1 openSUSE Tumbleweed:grub2-branding-upstream-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-debug-2.06-7.1 openSUSE Tumbleweed:grub2-snapper-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-systemd-sleep-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-debug-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-xen-2.06-7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-27749.html CVE-2020-27749 https://bugzilla.suse.com/1179264 SUSE Bug 1179264 A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2020-27779 openSUSE Tumbleweed:grub2-2.06-7.1 openSUSE Tumbleweed:grub2-branding-upstream-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-debug-2.06-7.1 openSUSE Tumbleweed:grub2-snapper-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-systemd-sleep-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-debug-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-xen-2.06-7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-27779.html CVE-2020-27779 https://bugzilla.suse.com/1179265 SUSE Bug 1179265 A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2021-20225 openSUSE Tumbleweed:grub2-2.06-7.1 openSUSE Tumbleweed:grub2-branding-upstream-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-debug-2.06-7.1 openSUSE Tumbleweed:grub2-snapper-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-systemd-sleep-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-debug-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-xen-2.06-7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-20225.html CVE-2021-20225 https://bugzilla.suse.com/1182262 SUSE Bug 1182262 A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2021-20233 openSUSE Tumbleweed:grub2-2.06-7.1 openSUSE Tumbleweed:grub2-branding-upstream-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-2.06-7.1 openSUSE Tumbleweed:grub2-i386-pc-debug-2.06-7.1 openSUSE Tumbleweed:grub2-snapper-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-systemd-sleep-plugin-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-efi-debug-2.06-7.1 openSUSE Tumbleweed:grub2-x86_64-xen-2.06-7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-20233.html CVE-2021-20233 https://bugzilla.suse.com/1182263 SUSE Bug 1182263 https://bugzilla.suse.com/1183135 SUSE Bug 1183135