Bug 1825243 (CVE-2020-10713) - CVE-2020-10713 grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process
Summary: CVE-2020-10713 grub2: Crafted grub.cfg file can lead to arbitrary code execut...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-10713
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Red Hat1834397 Red Hat1834398 Red Hat1834399 Red Hat1834400 Red Hat1834401 Red Hat1834402 Red Hat1837417 Red Hat1837418 Red Hat1837419 Red Hat1837420 Red Hat1837422 Red Hat1837424 Red Hat1837425 Red Hat1837426 Red Hat1837427 Red Hat1837428 Red Hat1837429 Red Hat1837430 Red Hat1837431 Red Hat1837432 Red Hat1837433 Red Hat1837434 Embargoed1837435 Red Hat1837436 Red Hat1837437 Red Hat1837438 Red Hat1837439 Red Hat1837440 Red Hat1837441 Red Hat1837442 Embargoed1837443 Red Hat1860101 Red Hat1860102 Red Hat1860103 Red Hat1860105 Red Hat1860106 Red Hat1860107 Red Hat1860108 Red Hat1860109 Red Hat1860110 Red Hat1860111 Red Hat1860112 Embargoed1860113 Embargoed1860114 Red Hat1860115 Red Hat1860116 Red Hat1860117 Red Hat1860118 Red Hat1860119 Embargoed1860120 Embargoed1860121 Embargoed1860122 Embargoed1860123 Red Hat1860145 Red Hat1860146 Red Hat1860147 Red Hat1860148 Red Hat1860149 Red Hat1860150 Red Hat1860151 Red Hat1860152 Red Hat1860153 Red Hat1860154 Red Hat1860155 Red Hat1860514 Red Hat1860515 Red Hat1860516 Red Hat1860517 1863015 Engineering1867554 Engineering1867555
Blocks: Embargoed1822339 Red Hat1829882
TreeView+ depends on / blocked
 
Reported: 2020-04-17 13:21 UTC by Marco Benatto
Modified: 2021-03-03 07:24 UTC (History)
54 users (show)

Fixed In Version: grub 2.06
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Clone Of:
Environment:
Last Closed: 2020-07-29 19:27:41 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:3216 0 None None None 2020-07-29 18:30:24 UTC
Red Hat Product Errata RHSA-2020:3217 0 None None None 2020-07-29 19:34:03 UTC
Red Hat Product Errata RHSA-2020:3223 0 None None None 2020-07-29 19:37:48 UTC
Red Hat Product Errata RHSA-2020:3227 0 None None None 2020-07-29 20:14:44 UTC
Red Hat Product Errata RHSA-2020:3271 0 None None None 2020-08-03 11:52:28 UTC
Red Hat Product Errata RHSA-2020:3273 0 None None None 2020-08-03 10:57:05 UTC
Red Hat Product Errata RHSA-2020:3274 0 None None None 2020-08-03 12:05:49 UTC
Red Hat Product Errata RHSA-2020:3275 0 None None None 2020-08-03 11:14:01 UTC
Red Hat Product Errata RHSA-2020:3276 0 None None None 2020-08-03 12:02:27 UTC
Red Hat Product Errata RHSA-2020:4115 0 None None None 2020-09-30 10:13:08 UTC
Red Hat Product Errata RHSA-2020:4172 0 None None None 2020-10-05 13:09:42 UTC

Description Marco Benatto 2020-04-17 13:21:03 UTC 
On grub2 up to version 2.04, it's possible to inject code and subvert the boot process via a specially crafted grub configuration file. When grubx64.efi loads the malicious configuration file, the contents of a grub_parser_param structure are overwritten with string contents from the crafted input leading to arbitrary code execution. The boot process can be subverted even with secure boot enabled.
Comment 2 Marco Benatto 2020-04-20 20:30:25 UTC 
Acknowledgments:

Name: Jesse Michael (Eclypsium), Mickey Shkatov (Eclypsium)
Comment 14 Marco Benatto 2020-07-27 14:10:03 UTC 
There's an issue with grub2 package. The grub2 is configured via grub.cfg configuration file, this file itself is composed by several key/values entries and it's parsed when grub2 is loaded. When parsing file grub copies the values into an internal buffer with a predetermined size, however when detecting the string length is bigger than the max buffer size grub2 doesn't abort the execution which may lead to a heap based buffer overflow. An attacker may leverage this flaw but crafting a malicious grub.cfg file (either local or via sftp for netboot) leading to a possible arbitrary code execution during boot stage and possibly by-passing the Secure Boot mechanism if enabled.
Comment 30 Eric Christensen 2020-07-29 14:54:18 UTC 
Mitigation:

There is no mitigation for the flaw.
Comment 32 Marco Benatto 2020-07-29 15:39:44 UTC 
Statement:

Kernel and kernel-rt packages as shipped with Red Hat Enterprise Linux 7 and 8 are being updated to contain the new Red Hat certificate for secure boot.
Comment 33 Marco Benatto 2020-07-29 18:14:15 UTC 
External References:

https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
https://www.openwall.com/lists/oss-security/2020/07/29/3
https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
Comment 34 errata-xmlrpc 2020-07-29 18:30:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3216 https://access.redhat.com/errata/RHSA-2020:3216
Comment 35 Product Security DevOps Team 2020-07-29 19:27:41 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10713
Comment 36 errata-xmlrpc 2020-07-29 19:34:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3217 https://access.redhat.com/errata/RHSA-2020:3217
Comment 37 errata-xmlrpc 2020-07-29 19:37:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:3223 https://access.redhat.com/errata/RHSA-2020:3223
Comment 38 errata-xmlrpc 2020-07-29 20:14:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:3227 https://access.redhat.com/errata/RHSA-2020:3227
Comment 45 errata-xmlrpc 2020-08-03 10:57:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Advanced Update Support

Via RHSA-2020:3273 https://access.redhat.com/errata/RHSA-2020:3273
Comment 46 errata-xmlrpc 2020-08-03 11:13:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2020:3275 https://access.redhat.com/errata/RHSA-2020:3275
Comment 47 errata-xmlrpc 2020-08-03 11:52:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Extended Update Support

Via RHSA-2020:3271 https://access.redhat.com/errata/RHSA-2020:3271
Comment 48 errata-xmlrpc 2020-08-03 12:02:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Advanced Update Support
  Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.3 Telco Extended Update Support

Via RHSA-2020:3276 https://access.redhat.com/errata/RHSA-2020:3276
Comment 49 errata-xmlrpc 2020-08-03 12:05:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2020:3274 https://access.redhat.com/errata/RHSA-2020:3274
Comment 54 errata-xmlrpc 2020-09-30 10:13:04 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2020:4115 https://access.redhat.com/errata/RHSA-2020:4115
Comment 55 errata-xmlrpc 2020-10-05 13:09:37 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2020:4172 https://access.redhat.com/errata/RHSA-2020:4172
Note You need to log in before you can comment on or make changes to this bug.