Bug 1886936 (CVE-2020-25647)

Summary:	CVE-2020-25647 grub2: Out-of-bounds write in grub_usb_device_initialize()
Product:	[Other] Security Response	Reporter:	Marco Benatto <mbenatto>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bootloader-eng-team, fmartine, lkundrak, pjanda, pjones, rhughes, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	grub 2.06	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in grub2. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-03-03 01:02:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1913890, 1913891, 1913892, 1913893, 1913894, 1913895, 1913896, 1913897, 1913898, 1913899, 1913900, 1932555, 1932556, 1932558, 1932559, 1932560, 1932561, 1932562, 1932563, 1932564, 1932565, 1932566, 1932567, 1932568, 1932569, 1932570, 1932571, 1932572, 1932573, 1932574, 1932575, 1932576, 1932577, 1932578, 1932579, 1932580, 1932581, 1932582, 1932583, 1932584, 1932585, 1932883, 1932884, 1934248, 1989986, 1989991, 1990885, 1990886, 1990888, 1990890
Bug Blocks:	1899965

Description Marco Benatto 2020-10-09 18:56:26 UTC

grub_usb_device_initialize() is called to handle USB device initialization. it reads out the descriptors it needs from the USB device and uses that data to fill in some USB data structures. grub_usb_device_initialize() performs very little bounds checking and simply assumes the USB device provides sane values. This behavior can trigger memory corruption. If properly exploited, this would lead to arbitrary code execution allowing the attacker to by-pass SecureBoot mechanism.

Comment 2 Marco Benatto 2020-12-29 14:56:58 UTC

Acknowledgments:

Name: Joseph Tartaro (IOActive), Ilja van Sprundel (IOActive)

Comment 6 Marco Benatto 2021-02-25 15:34:43 UTC

Marking fwupdate as WONTFIX for all rhel8 streams. This package was made obsolete and replaced by fwupd.

Comment 7 Marco Benatto 2021-03-02 18:39:44 UTC

Created grub2 tracking bugs for this issue:

Affects: fedora-all [bug 1934248]

Comment 8 errata-xmlrpc 2021-03-02 19:17:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:0698 https://access.redhat.com/errata/RHSA-2021:0698

Comment 9 errata-xmlrpc 2021-03-02 19:21:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0696 https://access.redhat.com/errata/RHSA-2021:0696

Comment 10 errata-xmlrpc 2021-03-02 19:25:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0697 https://access.redhat.com/errata/RHSA-2021:0697

Comment 11 errata-xmlrpc 2021-03-02 19:36:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Advanced Update Support

Via RHSA-2021:0703 https://access.redhat.com/errata/RHSA-2021:0703

Comment 12 errata-xmlrpc 2021-03-02 19:53:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Advanced Update Support

Via RHSA-2021:0704 https://access.redhat.com/errata/RHSA-2021:0704

Comment 13 errata-xmlrpc 2021-03-02 20:09:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2021:0702 https://access.redhat.com/errata/RHSA-2021:0702

Comment 14 errata-xmlrpc 2021-03-02 20:47:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0699 https://access.redhat.com/errata/RHSA-2021:0699

Comment 15 errata-xmlrpc 2021-03-02 20:50:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2021:0700 https://access.redhat.com/errata/RHSA-2021:0700

Comment 16 errata-xmlrpc 2021-03-02 21:01:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Extended Update Support

Via RHSA-2021:0701 https://access.redhat.com/errata/RHSA-2021:0701

Comment 17 Product Security DevOps Team 2021-03-03 01:02:01 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-25647

Comment 18 errata-xmlrpc 2021-05-18 14:37:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1734 https://access.redhat.com/errata/RHSA-2021:1734

Comment 19 errata-xmlrpc 2021-06-29 16:26:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:2566 https://access.redhat.com/errata/RHSA-2021:2566

Comment 20 errata-xmlrpc 2021-07-20 22:09:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:2790 https://access.redhat.com/errata/RHSA-2021:2790

Comment 21 errata-xmlrpc 2021-09-28 14:34:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:3675 https://access.redhat.com/errata/RHSA-2021:3675