CVE-2020-14311

Name of the Vulnerable Software and Affected Versions grub2 versions prior to 2.06

Description The issue is related to a buffer overflow when handling symbolic links in ext filesystems. An arithmetic overflow occurs when a filesystem contains a symbolic link with an inode size of UINT32 MAX, leading to a zero-sized memory allocation and a subsequent heap-based buffer overflow. This can allow an attacker to compromise data integrity or cause a denial of service.

Recommendations For grub2 versions prior to 2.06, consider updating to version 2.06 or later to resolve the issue. As a temporary workaround, restrict the use of symbolic links in ext filesystems to minimize the risk of exploitation.