CVE-2020-10713: GRUB2 Local Code Execution Vulnerability Alert

by ddos · July 31, 2020

GRUB2 is currently the most mainstream *nix operating system boot program. It allows users to have multiple operating systems in the computer at the same time and supports a real-time selection of the specified operating system when the computer starts. At the same time, GRUB can be used to select different kernels on the operating system partition, and it can also be used to pass startup parameters to these kernels. On July 29, 2020, Eclypsium had issued a risk notice for the GRUB2 buffer overflow vulnerability. The vulnerability number is CVE-2020-10713, and the vulnerability level is high.

GRUB2 exists a buffer overflow vulnerability. Local attackers can conduct arbitrary code execution by setting a special grub.cfg configuration file.

Vulnerability details

GRUB2 has a buffer overflow vulnerability when processing its own configuration file grub.cfg. By creating a specially crafted grub.cfg file, a local attacker can control the affected device without restriction after the next restart.

The exploitation of this vulnerability requires that the attacker has obtained the highest authority of the operating system. The main significance is that it can provide a hidden and long-resident high-privilege backdoor (bootkit).