CVE-2020-27749

Name of the Vulnerable Software and Affected Versions grub2 versions prior to 2.06

Description A flaw was found in grub2 where variable names in the command line are expanded into their corresponding contents using a 1kB stack buffer without sufficient bounds checking. This can lead to a stack buffer overflow if a variable with a large payload is referenced, potentially corrupting the stack frame and controlling execution, which could also circumvent Secure Boot protections. The highest threat from this issue is to data confidentiality and integrity as well as system availability.

Recommendations For versions prior to 2.06, update to version 2.06 or later to resolve the issue. As a temporary workaround, consider restricting the use of variables in the command line to minimize the risk of exploitation. Avoid using variables with large payloads in the command line until the issue is resolved.