CVE-2020-14311

CVE Details

Release Date:2020-07-31
Impact:None What is this?

Description


There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow.

See more information about CVE-2020-14311 from MITRE CVE dictionary and NIST NVD


NOTE: The following CVSS metrics and score provided are preliminary and subject to review.


CVSS v3 metrics

Base Score: 6.0
Vector String: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Version: 3.0
Attack Vector: Local
Attack Complexity: Low
Privileges Required: High
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: High
Availability Impact: High

Errata information


PlatformErrataRelease Date
Oracle Linux version 7 (grub2)ELSA-2020-57822020-07-29
Oracle Linux version 7 (grub2)ELSA-2020-57902020-07-29
Oracle Linux version 8 (grub2)ELSA-2020-57862020-07-29


This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections:

software.hardware.complete