CVE-2020-14372 Security feature bypass in grub2
An attacker with privileged access can bypass Secure Boot lockdown via crafted ACPI tables to load unsigned code, compromising system integrity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-14372?
CVE-2020-14372 is a high-severity vulnerability in Fedoraproject Fedora, published on 3 Mar 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability.
Weakness: CWE-184
Which versions are affected by CVE-2020-14372?
It affects 9 products.
Products include Fedoraproject Fedora, Gnu Grub2, Netapp Cloud Backup, Netapp Ontap Select Deploy Administration Utility, Redhat Enterprise Linux, Redhat Enterprise Linux Server Aus and 3 more.
How do I fix CVE-2020-14372?
Upgrade to a fixed version.
Is CVE-2020-14372 being exploited?
There is no known exploitation of CVE-2020-14372 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2020-14372, AZL-6460, DEBIAN-CVE-2020-14372, GHSA-xh73-rjw5-phcw, UBUNTU-CVE-2020-14372.