CVE-2020-15705GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim

Description

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
• https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass vendor-advisory
• http://ubuntu.com/security/notices/USN-4432-1 vendor-advisory
• https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot vendor-advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011
• https://access.redhat.com/security/vulnerabilities/grub2bootloader vendor-advisory
• https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/ vendor-advisory
• https://www.suse.com/support/kb/doc/?id=000019673 vendor-advisory
• https://www.openwall.com/lists/oss-security/2020/07/29/3
• https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
• [oss-security] 20200729 multiple secure boot grub2 and linux kernel vulnerabilities mailing-list
• https://security.netapp.com/advisory/ntap-20200731-0008/
• USN-4432-1 vendor-advisory
• openSUSE-SU-2020:1280 vendor-advisory
• openSUSE-SU-2020:1282 vendor-advisory
• [oss-security] 20210302 Multiple GRUB2 vulnerabilities mailing-list
• GLSA-202104-05 vendor-advisory
• [oss-security] 20210916 Containers-optimized OS (COS) membership in the linux-distros list mailing-list
• [oss-security] 20210917 Re: Containers-optimized OS (COS) membership in the linux-distros list mailing-list
• [oss-security] 20210920 Re: Containers-optimized OS (COS) membership in the linux-distros list mailing-list