Bug 1852009 (CVE-2020-14308)
| Summary: | CVE-2020-14308 grub2: grub_malloc does not validate allocation size allowing for arithmetic overflow and subsequent heap-based buffer overflow | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marco Benatto <mbenatto> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | bootloader-eng-team, fmartine, lkundrak, pjones, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | grub 2.06 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in current grub2 versions as shipped with Red Hat Enterprise Linux 7 and 8, where the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This issue leads the function to return invalid memory allocations, causing heap-based overflows in several code paths. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-07-29 19:27:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1853688, 1853689, 1853690, 1853691, 1853692, 1853693, 1853694, 1853695, 1853696, 1853697, 1853698, 1853699, 1863017 | ||
| Bug Blocks: | 1852004 | ||
|
Description
Marco Benatto
2020-06-29 15:23:25 UTC
In the current grub versions, grub_malloc() malloc function doesn't validate if the allocation size may overflow the maximum type representation. This leads grub_malloc() to return invalid allocations, an attacker may leverage causing memory corruption leading to possible integrity, confidentiality and availability impacts. To be able to exploit this the attacker needs local privileged or physical access to the machine. Acknowledgments: Name: Chris Coulson (Ubuntu Security Team) This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:3216 https://access.redhat.com/errata/RHSA-2020:3216 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-14308 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:3217 https://access.redhat.com/errata/RHSA-2020:3217 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:3223 https://access.redhat.com/errata/RHSA-2020:3223 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:3227 https://access.redhat.com/errata/RHSA-2020:3227 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.2 Advanced Update Support Via RHSA-2020:3273 https://access.redhat.com/errata/RHSA-2020:3273 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.4 Advanced Update Support Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions Red Hat Enterprise Linux 7.4 Telco Extended Update Support Via RHSA-2020:3275 https://access.redhat.com/errata/RHSA-2020:3275 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.6 Extended Update Support Via RHSA-2020:3271 https://access.redhat.com/errata/RHSA-2020:3271 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.3 Advanced Update Support Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions Red Hat Enterprise Linux 7.3 Telco Extended Update Support Via RHSA-2020:3276 https://access.redhat.com/errata/RHSA-2020:3276 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Extended Update Support Via RHSA-2020:3274 https://access.redhat.com/errata/RHSA-2020:3274 Created grub2 tracking bugs for this issue: Affects: fedora-all [bug 1863017] |