CVE-2020-14309

Name of the Vulnerable Software and Affected Versions Grub2 versions prior to 2.06

Description The issue is related to an integer overflow of the UINT32 value, which can allow an attacker to access confidential data, compromise its integrity, and cause a denial of service. Specifically, the problem occurs when handling squashfs filesystems that contain a symbolic link with a name length of UINT32 bytes, leading to an arithmetic overflow and a heap-based buffer overflow with attacker-controlled data.

Recommendations For Grub2 versions prior to 2.06, update to version 2.06 or later to resolve the issue. As a temporary workaround, consider avoiding the use of squashfs filesystems with symbolic links that could trigger the overflow until a patch is applied. Restrict access to sensitive data handled by Grub2 to minimize the risk of exploitation.