CVE-2020-15707

描述

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.

如何修補 CVE-2020-15707

要修補 CVE-2020-15707,請將受影響套件升級到下列已修補版本。

• —升級至 2.06-r0 或更新版本
• —升級至 2.04-9 或更新版本

CVE-2020-15707 正在被利用嗎?

低 — EPSS 為 1.6%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 2.06-r0
• from 0, < 2.04-9

CVSS 分數

參考連結(2)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2020-15707
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2020-15707