{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/174059#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nThe GRUB2 boot loader is vulnerable to buffer overflow, which results in arbitrary code execution during the boot process, even when Secure Boot is enabled. \r\n\r\n### Description\r\n[GRUB2](https://www.gnu.org/software/grub/) is a multiboot boot loader that replaced GRUB Legacy in [2012](https://www.archlinux.org/news/grub-legacy-no-longer-supported/). A boot loader is the first  program that runs upon boot and loads the operating system. Many vendors also use a shim, a signed software package that contains the vendor’s certificate and code that verifies and runs the boot loader. This means that firmware Certificate Authority providers can just sign the shim as opposed to all of the other supported programs.\r\n\r\nGRUB2 is vulnerable to a buffer overflow when parsing content from the GRUB2 configuration file (grub.cfg). This configuration file is an external file commonly located in the EFI System Partition and can therefore be modified by an attacker with administrator privileges without altering the integrity of the signed vendor shim and GRUB2 boot loader executables. This could allow an authenticated, local attacker to modify the contents of the GRUB2 configuration file to ensure that the attacker's chosen code is run before the operating system is loaded. This could allow the attacker to gain persistence on the device, even with Secure Boot enabled. All versions of GRUB2 that load commands from an external grub.cfg configuration file are vulnerable.\r\n\r\n### Impact\r\nAn authenticated, local attacker could modify the contents of the GRUB2 configuration file to execute arbitrary code that bypasses signature verification. This could allow the attacker to gain persistence on the device, even with Secure Boot enabled. Because the attacker's code runs before the operating system, the attacker could control how the operating system is loaded, directly patch the operating system, or even direct the bootloader to alternate OS images. All versions of GRUB2 that load commands from an external grub.cfg configuration file are vulnerable.\r\n\r\n### Solution\r\n\r\n**Apply an update if operationally feasible**\r\n\r\nUpdate GRUB2 to the latest version to address this vulnerability when operationally feasible. Some [patches](https://access.redhat.com/solutions/5272311) were originally reported to leave systems unbootable so users are encouraged to review and test patches prior to implementing them. Linux distributions and other vendors using GRUB2 will need to update their installers, boot loaders, and shims. New shims will need to be signed by the Microsoft 3rd Party UEFI Certificate Authority. Administrators of affected devices will need to update installed versions of operating systems as well as installer images, including disaster recovery media. Until all affected versions are added to the dbx revocation list, an attacker would be able to use a vulnerable version of shim and GRUB2. Eventually the UEFI revocation list (dbx) needs to be updated in the firmware of each affected system to prevent running this vulnerable code during boot.\r\n\r\n\r\n### Acknowledgements\r\nThanks to Mickey Shkatov and Jesse Michael from Eclypsium for reporting this vulnerability.\r\n\r\n This document was written by Madison Oliver.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/174059"},{"url":"https://eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/","summary":"https://eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/"},{"url":"https://www.gnu.org/software/grub/","summary":"https://www.gnu.org/software/grub/"},{"url":"https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot/","summary":"https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot/"},{"url":"https://www.archlinux.org/news/grub-legacy-no-longer-supported/","summary":"https://www.archlinux.org/news/grub-legacy-no-longer-supported/"},{"url":"https://wiki.debian.org/SecureBoot","summary":"https://wiki.debian.org/SecureBoot"},{"url":"https://uefi.org/","summary":"https://uefi.org/"},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011","summary":"Reference(s) from vendor \"Microsoft\""},{"url":"https://access.redhat.com/security/vulnerabilities/grub2bootloader","summary":"Reference(s) from vendor \"Red Hat Inc.\""},{"url":"https://access.redhat.com/solutions/5272311","summary":"Reference(s) from vendor \"Red Hat Inc.\""},{"url":"https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass","summary":"Reference(s) from vendor \"Ubuntu\""},{"url":"https://lists.centos.org/pipermail/centos-announce/2020-July/035778.html","summary":"Reference(s) from vendor \"CentOS\""},{"url":"https://www.debian.org/security/2020/dsa-4735","summary":"Reference(s) from vendor \"Debian GNU/Linux\""},{"url":"https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot/","summary":"Reference(s) from vendor \"Debian GNU/Linux\""},{"url":"https://www.suse.com/support/kb/doc/?id=000019673","summary":"Reference(s) from vendor \"SUSE Linux\""},{"url":"https://kb.vmware.com/s/article/80181","summary":"Reference(s) from vendor \"VMware\""}],"title":"GRUB2 bootloader is vulnerable to buffer overflow","tracking":{"current_release_date":"2020-08-13T17:52:30+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.35"}},"id":"VU#174059","initial_release_date":"2020-07-29 17:02:57.519444+00:00","revision_history":[{"date":"2020-08-13T17:52:30+00:00","number":"1.20200813175230.6","summary":"Released on 2020-08-13T17:52:30+00:00"}],"status":"final","version":"1.20200813175230.6"}},"vulnerabilities":[{"title":"The grub2 bootloader can be exploited through the use of a modified grub.","notes":[{"category":"summary","text":"The grub2 bootloader can be exploited through the use of a modified grub.cfg configuration file. This can be used to to gain arbitrary code execution during the boot process when Secure Boot is enabled and enforcing signature verification and is effectively a bypass of Secure Boot that can be used to install a persistent bootkit."}],"cve":"CVE-2020-10713","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#174059"}],"product_status":{"known_affected":["CSAFPID-2a9beca0-3a7f-11f1-a172-0afffb3ee71d","CSAFPID-2a9c222e-3a7f-11f1-a172-0afffb3ee71d","CSAFPID-2a9c65f4-3a7f-11f1-a172-0afffb3ee71d","CSAFPID-2a9cca58-3a7f-11f1-a172-0afffb3ee71d","CSAFPID-2a9d0af4-3a7f-11f1-a172-0afffb3ee71d","CSAFPID-2a9d6080-3a7f-11f1-a172-0afffb3ee71d","CSAFPID-2a9d9992-3a7f-11f1-a172-0afffb3ee71d","CSAFPID-2a9debf4-3a7f-11f1-a172-0afffb3ee71d"]}}],"product_tree":{"branches":[{"category":"vendor","name":"VMware","product":{"name":"VMware Products","product_id":"CSAFPID-2a9beca0-3a7f-11f1-a172-0afffb3ee71d"}},{"category":"vendor","name":"Ubuntu","product":{"name":"Ubuntu Products","product_id":"CSAFPID-2a9c222e-3a7f-11f1-a172-0afffb3ee71d"}},{"category":"vendor","name":"CentOS","product":{"name":"CentOS Products","product_id":"CSAFPID-2a9c65f4-3a7f-11f1-a172-0afffb3ee71d"}},{"category":"vendor","name":"Debian GNU/Linux","product":{"name":"Debian GNU/Linux Products","product_id":"CSAFPID-2a9cca58-3a7f-11f1-a172-0afffb3ee71d"}},{"category":"vendor","name":"SUSE Linux","product":{"name":"SUSE Linux Products","product_id":"CSAFPID-2a9d0af4-3a7f-11f1-a172-0afffb3ee71d"}},{"category":"vendor","name":"Microsoft","product":{"name":"Microsoft Products","product_id":"CSAFPID-2a9d6080-3a7f-11f1-a172-0afffb3ee71d"}},{"category":"vendor","name":"Red Hat Inc.","product":{"name":"Red Hat Inc. Products","product_id":"CSAFPID-2a9d9992-3a7f-11f1-a172-0afffb3ee71d"}},{"category":"vendor","name":"GNU Grub","product":{"name":"GNU Grub Products","product_id":"CSAFPID-2a9debf4-3a7f-11f1-a172-0afffb3ee71d"}}]}}