CVE-2020-25647

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	grub2	grub 2.06

References

https://bugzilla.redhat.com/show_bug.cgi?id=1886936Issue Tracking, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/
https://security.gentoo.org/glsa/202104-05Third Party Advisory
https://security.netapp.com/advisory/ntap-20220325-0001/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1886936Issue Tracking, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/
https://security.gentoo.org/glsa/202104-05Third Party Advisory
https://security.netapp.com/advisory/ntap-20220325-0001/Third Party Advisory

Timeline

Published: Mar 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-256487.5A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS CVE-2020-256497.5A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to X CVE-2020-25657.5Vulnerability in the Oracle Solaris product of Oracle Systems (component: Consolidation Infrastructure). The supported version that is affec CVE-2020-256505.5A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged l CVE-2020-256516.4A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection CVE-2020-256525.5A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX doma CVE-2020-256536.3A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivi CVE-2020-256547.2An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communi CVE-2020-256556.5An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views CVE-2020-256564.1A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. CVE-2020-256575.9A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API CVE-2020-256585.9It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to dec