Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2020-14372

Incomplete List of Disallowed Inputs

Published: Mar 03, 2021 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 2.x
6.2 MEDIUM
AV:L/AC:H/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2020-14372
CWEhttps://cwe.mitre.org/data/definitions/184.html

A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability.

Weakness

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Affected Software

NameVendorStart VersionEnd Version
Grub2Gnu*2.06 (excluding)
Red Hat Enterprise Linux 7RedHatgrub2-1:2.02-0.87.el7_9.2*
Red Hat Enterprise Linux 7.2 Advanced Update SupportRedHatgrub2-1:2.02-0.86.el7_2.2*
Red Hat Enterprise Linux 7.3 Advanced Update SupportRedHatgrub2-1:2.02-0.86.el7_3.2*
Red Hat Enterprise Linux 7.4 Advanced Update SupportRedHatgrub2-1:2.02-0.86.el7_4.2*
Red Hat Enterprise Linux 7.4 Telco Extended Update SupportRedHatgrub2-1:2.02-0.86.el7_4.2*
Red Hat Enterprise Linux 7.4 Update Services for SAP SolutionsRedHatgrub2-1:2.02-0.86.el7_4.2*
Red Hat Enterprise Linux 7.6 Extended Update SupportRedHatgrub2-1:2.02-0.86.el7_6.3*
Red Hat Enterprise Linux 7.7 Extended Update SupportRedHatgrub2-1:2.02-0.86.el7_7.3*
Red Hat Enterprise Linux 8RedHatgrub2-1:2.02-90.el8_3.1*
Red Hat Enterprise Linux 8RedHatshim-0:15.4-2.el8_1*
Red Hat Enterprise Linux 8RedHatshim-unsigned-aarch64-0:15-7.el8_1*
Red Hat Enterprise Linux 8RedHatshim-unsigned-x64-0:15.4-4.el8_1*
Red Hat Enterprise Linux 8RedHatfwupd-0:1.5.9-1.el8_4*
Red Hat Enterprise Linux 8.1 Extended Update SupportRedHatgrub2-1:2.02-87.el8_1.2*
Red Hat Enterprise Linux 8.1 Extended Update SupportRedHatfwupd-0:1.1.4-4.el8_1*
Red Hat Enterprise Linux 8.1 Extended Update SupportRedHatshim-0:15.4-2.el8_1*
Red Hat Enterprise Linux 8.1 Extended Update SupportRedHatshim-unsigned-aarch64-0:15-7.el8_1*
Red Hat Enterprise Linux 8.1 Extended Update SupportRedHatshim-unsigned-x64-0:15.4-4.el8_1*
Red Hat Enterprise Linux 8.2 Extended Update SupportRedHatgrub2-1:2.02-87.el8_2.3*
Red Hat Enterprise Linux 8.2 Extended Update SupportRedHatfwupd-0:1.1.4-9.el8_2*
Red Hat Enterprise Linux 8.2 Extended Update SupportRedHatshim-0:15.4-2.el8_1*
Red Hat Enterprise Linux 8.2 Extended Update SupportRedHatshim-unsigned-aarch64-0:15-7.el8_1*
Red Hat Enterprise Linux 8.2 Extended Update SupportRedHatshim-unsigned-x64-0:15.4-4.el8_1*
Grub2Ubuntubionic*
Grub2Ubuntutrusty*
Grub2Ubuntuxenial*
Grub2-signedUbuntubionic*
Grub2-signedUbuntuesm-infra-legacy/trusty*
Grub2-signedUbuntuesm-infra/bionic*
Grub2-signedUbuntuesm-infra/focal*
Grub2-signedUbuntuesm-infra/xenial*
Grub2-signedUbuntufocal*
Grub2-signedUbuntugroovy*
Grub2-signedUbuntuhirsute*
Grub2-signedUbuntuimpish*
Grub2-signedUbuntutrusty*
Grub2-signedUbuntutrusty/esm*
Grub2-signedUbuntuxenial*
Grub2-unsignedUbuntubionic*
Grub2-unsignedUbuntuesm-infra/bionic*
Grub2-unsignedUbuntuesm-infra/focal*
Grub2-unsignedUbuntuesm-infra/xenial*
Grub2-unsignedUbuntufocal*
Grub2-unsignedUbuntugroovy*
Grub2-unsignedUbuntuhirsute*
Grub2-unsignedUbuntuimpish*
Grub2-unsignedUbuntuprecise/esm*
Grub2-unsignedUbuntutrusty*
Grub2-unsignedUbuntuxenial*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use