CVE-2020-14308

NameCVE-2020-14308
DescriptionIn grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4735-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
grub2 (PTS)stretch2.02~beta3-5+deb9u2vulnerable
buster, buster (security)2.02+dfsg1-20+deb10u2fixed
bullseye2.04-8vulnerable
sid2.04-9fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
grub2sourcebuster2.02+dfsg1-20+deb10u1DSA-4735-1
grub2source(unstable)2.04-9

Notes

[stretch] - grub2 <ignored> (No SecureBoot support in stretch)
https://www.openwall.com/lists/oss-security/2020/07/29/3
https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=f725fa7cb2ece547c5af01eeeecfe8d95802ed41

Search for package or bug name: Reporting problems