CVE-2020-15707

Name of the Vulnerable Software and Affected Versions Grub2 versions prior to 2.04

Description The issue is related to the implementation of the grub cmd initrd and grub initrd init functions in Grub2, which can be exploited by passing a large number of arguments to the initrd command on 32-bit architectures, or by using a crafted filesystem with very large files on any architecture. This can lead to a heap-based buffer overflow, allowing an attacker to execute arbitrary code, bypass UEFI Secure Boot restrictions, and compromise data confidentiality and integrity.

Recommendations For Grub2 versions prior to 2.04, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting the use of the initrd command on 32-bit architectures to minimize the risk of exploitation. Additionally, avoid using crafted filesystems with very large files until the issue is resolved.