CVE-2020-14310

Name of the Vulnerable Software and Affected Versions grub2 versions prior to 2.06

Description The issue is related to the read section as string() function, which expects a font name to be at most UINT32 MAX - 1 length in bytes but does not verify it before proceeding with buffer allocation. This can lead to an arithmetic overflow, zero-sized allocation, and further heap-based buffer overflow when a malicious font file with a name of UINT32 MAX length is crafted. An attacker may leverage this to impact data integrity or cause a denial of service.

Recommendations For versions prior to 2.06, as a temporary workaround, consider disabling the read section as string() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.