Colin Watson

The issue is related to the implementation of the `grub cmd initrd` and `grub initrd init` functions in Grub2, which can be exploited by passing a large number of arguments to the `initrd` command on 32-bit architectures, or by using a crafted filesystem with very large files on any architecture. This can lead to a heap-based buffer overflow, allowing an attacker to execute arbitrary code, bypass UEFI Secure Boot restrictions, and compromise data confidentiality and integrity.

The issue allows remote attackers to install an alternate security policy and gain privileges via a crafted package. This can be demonstrated by the test.mmrow app for Ubuntu phone.

The issue concerns multiple vulnerabilities in the glibc package, which can lead to breaches of confidentiality, integrity, and availability of protected information. Exploitation can occur locally. Specifically, untrusted search path vulnerabilities in certain modified versions of glibc allow local users to gain privileges via a crafted dynamic shared object in a subdirectory of the current working directory during execution of a setuid or setgid program.

The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name.