Buffer Overflow Vulnerability in GRUB2 Bootloader Disclosed (CVE-2020-10713)

Researchers at Eclypsium disclosed a buffer overflow vulnerability in the GRand Unified Bootloader version 2 (GRUB2) on July 29. Identified as CVE-2020-10713, the researchers credited with its discovery call it “BootHole,” because it is a “hole” (or flaw) in a system’s “boot” process. Exploitation is not straightforward, as there are some prerequisites needed to exploit it. This follows 2013 research into a Secure Boot bypass from the same researchers. Because the flaw resides in GRUB2, a number of vendors are affected including Microsoft, Red Hat, Debian and more.

For more information about the vulnerability, including the list of affected vendors, availability of patches and Tenable product coverage, please visit our blog.