PublicDateAtUSN: 2021-03-02 18:00:00 UTC
Candidate: CVE-2020-14372
CRD: 2021-03-02 18:00:00 UTC
PublicDate: 2021-03-03 17:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14372
 https://ubuntu.com/security/notices/USN-4992-1
Description:
 A flaw was found in grub2 in versions prior to 2.06, where it incorrectly
 enables the usage of the ACPI command when Secure Boot is enabled. This
 flaw allows an attacker with privileged access to craft a Secondary System
 Description Table (SSDT) containing code to overwrite the Linux kernel
 lockdown variable content directly into memory. The table is further loaded
 and executed by the kernel, defeating its Secure Boot lockdown and allowing
 the attacker to load unsigned code. The highest threat from this
 vulnerability is to data confidentiality and integrity, as well as system
 availability.
Ubuntu-Description:
 Máté Kukri discovered that the acpi command in GRUB 2 allowed privileged
 users to load crafted ACPI tables when secure boot is enabled. An
 attacker could use this to bypass UEFI Secure Boot restrictions.
Notes:
 amurray| CVE title: "grub2: acpi command allows privileged user to load
  crafted ACPI tables when secure boot is enabled"
 sbeattie| grub2-unsigned will contain fixes and supersede grub2, which
  will contain only BIOS grub bits.
Mitigation:
Bugs:
Priority: medium
Discovered-by: Máté Kukri
Assigned-to:
CVSS:
 upstream: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H [7.5 HIGH]
 nvd: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H [7.5 HIGH]


Patches_grub2-unsigned:
upstream_grub2-unsigned: needs-triage
precise/esm_grub2-unsigned: ignored (end of ESM support, was needs-triage)
trusty_grub2-unsigned: ignored (out of standard support)
trusty/esm_grub2-unsigned: needs-triage
xenial_grub2-unsigned: pending (2.04-1ubuntu42)
esm-infra/xenial_grub2-unsigned: pending (2.04-1ubuntu42)
bionic_grub2-unsigned: released (2.04-1ubuntu44.1.2)
focal_grub2-unsigned: released (2.04-1ubuntu44.2)
groovy_grub2-unsigned: released (2.04-1ubuntu44.2)
hirsute_grub2-unsigned: released (2.04-1ubuntu42)
impish_grub2-unsigned: released (2.04-1ubuntu45)
jammy_grub2-unsigned: released (2.04-1ubuntu45)
devel_grub2-unsigned: released (2.04-1ubuntu45)

Patches_grub2-signed:
upstream_grub2-signed: needs-triage
precise/esm_grub2-signed: DNE
trusty_grub2-signed: ignored (out of standard support)
trusty/esm_grub2-signed: needs-triage
xenial_grub2-signed: ignored (end of standard support, was needs-triage)
esm-infra/xenial_grub2-signed: pending (1.164)
bionic_grub2-signed: released (1.167~18.04.5)
focal_grub2-signed: released (1.167.2)
groovy_grub2-signed: released (1.167.2)
hirsute_grub2-signed: released (1.164)
impish_grub2-signed: released (1.169)
jammy_grub2-signed: released (1.169)
devel_grub2-signed: released (1.169)