Memory Corruption Vulnerability in GRUB2 by Red Hat

CVE-2020-25647

What is CVE-2020-25647?

A flaw exists in GRUB2 that arises during USB device initialization due to inadequate bounds checking when reading device descriptors. This oversight assumes that the USB device presents valid values. If an attacker successfully exploits this vulnerability, it may result in memory corruption, enabling arbitrary code execution and a successful bypass of the Secure Boot functionality. The potential impact includes severe threats to data confidentiality, integrity, and overall system availability.

References