Vulnerabilities > CVE-2019-14865 - Unspecified vulnerability in GNU Grub2
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 | |
| OS | 2 |
Nessus
NASL family Huawei Local Security Checks NASL id EULEROS_SA-2020-1009.NASL description According to the version of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots.(CVE-2019-14865) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-05-03 modified 2020-01-02 plugin id 132602 published 2020-01-02 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132602 title EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2020-1009) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2020-0335.NASL description An update for grub2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Security Fix(es) : * grub2: grub2-set-bootflag utility causes grubenv corruption rendering the system non-bootable (CVE-2019-14865) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 133479 published 2020-02-05 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133479 title RHEL 8 : grub2 (RHSA-2020:0335) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2020-1045.NASL description According to the version of the grub2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots.(CVE-2019-14865) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 132799 published 2020-01-13 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132799 title EulerOS Virtualization for ARM 64 3.0.5.0 : grub2 (EulerOS-SA-2020-1045) NASL family Fedora Local Security Checks NASL id FEDORA_2019-E99EBF23C8.NASL description Fix a grub hidden-menu regression and a bug in blscfg variable expansion ---- Security fix for CVE-2019-14865 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 131465 published 2019-12-03 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/131465 title Fedora 31 : 1:grub2 (2019-e99ebf23c8) NASL family Fedora Local Security Checks NASL id FEDORA_2019-69DA274284.NASL description Drop patch fixing a corner case in BLS variable expansion since it may be causing issues ---- Fix a grub hidden-menu regression and a bug in blscfg variable expansion ---- Security fix for CVE-2019-14865 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 132408 published 2019-12-27 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132408 title Fedora 30 : 1:grub2 (2019-69da274284) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2019-4869.NASL description Description of changes: [2.02-78.0.2] - grub-set-bootflag: fix grubenv update method, fix CVE-2019-14865 [Orabug: 30607067] last seen 2020-06-01 modified 2020-06-02 plugin id 132305 published 2019-12-19 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132305 title Oracle Linux 8 : grub2 (ELSA-2019-4869) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2020-0335.NASL description From Red Hat Security Advisory 2020:0335 : An update for grub2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Security Fix(es) : * grub2: grub2-set-bootflag utility causes grubenv corruption rendering the system non-bootable (CVE-2019-14865) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 133590 published 2020-02-10 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133590 title Oracle Linux 8 : grub2 (ELSA-2020-0335)
Redhat
| advisories |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| rpms |
|
References
- http://www.openwall.com/lists/oss-security/2024/02/06/3
- http://www.openwall.com/lists/oss-security/2024/02/06/3
- https://access.redhat.com/errata/RHSA-2020:0335
- https://access.redhat.com/errata/RHSA-2020:0335
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14865
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14865
- https://seclists.org/oss-sec/2019/q4/101
- https://seclists.org/oss-sec/2019/q4/101