redhat enterprise-linux-atomic-host CVE-2020-15705 vulnerability in Red Hat and Other Products
Published on July 29, 2020

GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim

product logo product logo product logo product logo product logo product logo product logo product logo
GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2020-15705 can be exploited with local system access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
HIGH
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Improper Verification of Cryptographic Signature

The software does not verify, or incorrectly verifies, the cryptographic signature for data.


Products Associated with CVE-2020-15705

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2020-15705 are published in these products:

 
 
 
 
 
 
 
 
 
 
 
 
 
 

Affected Versions

grub2 in Ubuntu:

Exploit Probability

EPSS
0.03%
Percentile
9.31%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.