What’s Vulnerable › Vulnerabilities
CVE-2020-14310
- Severity: medium (CVSS 6.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-07-31 · updated 2026-06-17
- Weakness: CWE-122
Description
There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow.
Affected products
- Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 20.04
- grub2: before 2.06 — fixed in 2.06
- openSUSE Leap: 15.1, 15.2
- Red Hat Enterprise Linux: 7.0, 8.0
- RedHat Enterprise Linux Eus: 8.1, 8.2
- RedHat Enterprise Linux Server Aus: 8.2
- RedHat Enterprise Linux Server Tus: 8.2
How to fix
Upgrade to a fixed version: grub2 2.06. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14310
- https://security.gentoo.org/glsa/202104-05
- https://usn.ubuntu.com/4432-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14310
- https://security.gentoo.org/glsa/202104-05
- https://usn.ubuntu.com/4432-1/
Get alerted when CVE-2020-14310 or the next vulnerability affects your stack