GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.
CVE-2020-15706
6.4MEDIUM
What is CVE-2020-15706?
GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.
Affected Version(s)
grub2 in Ubuntu 20.04 LTS < 2.04-1ubuntu26.1
grub2 in Ubuntu 18.04 LTS < 2.02-2ubuntu8.16
grub2 in Ubuntu 16.04 LTS < 2.02~beta2-36ubuntu3.26