What’s Vulnerable › Vulnerabilities

CVE-2020-15707: GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-07-29 · updated 2026-06-17
• Weakness: CWE-362

Description

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 20.04
• Debian Linux: 10.0
• grub2: through 2.04
• Microsoft Windows 10 Version 1607: 1607, 1709, 1803, 1809, 1903, 1909 (+1)
• Microsoft Windows 8.1: all versions
• Microsoft Windows RT 8.1: all versions
• Microsoft Windows Server 2012: r2
• Microsoft Windows Server 2016: 1903, 1909, 2004
• Microsoft Windows Server 2019: all versions
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 9.5
• openSUSE Leap: 15.1, 15.2
• Red Hat Enterprise Linux: 7.0, 8.0
• RedHat Enterprise Linux Atomic Host: all versions
• Red Hat OpenShift Container Platform 4.18: 4.0
• SUSE Linux Enterprise: 11, 12, 15
• Ubuntu grub2 in Ubuntu: from 20.04 LTS before 2.04-1ubuntu26.1; from 18.04 LTS before 2.02-2ubuntu8.16; from 16.04 LTS before 2.02~beta2-36ubuntu3.26; from 14.04 ESM before 2.02~beta2-9ubuntu1.20 — fixed in 2.04-1ubuntu26.1, 2.02-2ubuntu8.16, 2.02~beta2-36ubuntu3.26, 2.02~beta2-9ubuntu1.20

How to fix

Upgrade to a fixed version: Ubuntu grub2 in Ubuntu 2.04-1ubuntu26.1, 2.02-2ubuntu8.16, 2.02~beta2-36ubuntu3.26, 2.02~beta2-9ubuntu1.20. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html
• http://ubuntu.com/security/notices/USN-4432-1
• http://www.openwall.com/lists/oss-security/2020/07/29/3
• https://access.redhat.com/security/vulnerabilities/grub2bootloader
• https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011
• https://security.gentoo.org/glsa/202104-05
• https://security.netapp.com/advisory/ntap-20200731-0008/
• https://usn.ubuntu.com/4432-1/
• https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
• https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot

Get alerted when CVE-2020-15707 or the next vulnerability affects your stack