CVE-2020-15706: GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-29 · updated 2026-06-17
Weakness: CWE-362

Description

GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 20.04
Debian Linux: 10.0
grub2: through 2.04
Microsoft Windows 10 Version 1607: 1607, 1709, 1803, 1809, 1903, 1909 (+1)
Microsoft Windows 8.1: all versions
Microsoft Windows RT 8.1: all versions
Microsoft Windows Server 2012: r2
Microsoft Windows Server 2016: 1903, 1909, 2004
Microsoft Windows Server 2019: all versions
openSUSE Leap: 15.1, 15.2
Red Hat Enterprise Linux: 7.0, 8.0
RedHat Enterprise Linux Atomic Host: all versions
Red Hat OpenShift Container Platform 4.18: 4.0
SUSE Linux Enterprise: 11, 12, 15
Ubuntu grub2 in Ubuntu: from 20.04 LTS before 2.04-1ubuntu26.1; from 18.04 LTS before 2.02-2ubuntu8.16; from 16.04 LTS before 2.02~beta2-36ubuntu3.26; from 14.04 ESM before 2.02~beta2-9ubuntu1.20 — fixed in 2.04-1ubuntu26.1, 2.02-2ubuntu8.16, 2.02~beta2-36ubuntu3.26, 2.02~beta2-9ubuntu1.20

How to fix

Upgrade to a fixed version: Ubuntu grub2 in Ubuntu 2.04-1ubuntu26.1, 2.02-2ubuntu8.16, 2.02~beta2-36ubuntu3.26, 2.02~beta2-9ubuntu1.20. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-15706 or the next vulnerability affects your stack