CVE-2020-25647

Name of the Vulnerable Software and Affected Versions grub2 versions prior to 2.06

Description A flaw was found in grub2 during USB device initialization, where descriptors are read with very little bounds checking, assuming the USB device provides sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution, allowing a bypass of the Secure Boot mechanism. The highest threat from this issue is to data confidentiality and integrity as well as system availability.

Recommendations For versions prior to 2.06, update to version 2.06 or later to resolve the issue. As a temporary workaround, consider restricting access to USB devices during the boot process to minimize the risk of exploitation.