VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 29, 2020· Updated Sep 17, 2024

GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim

CVE-2020-15705

Description

GRUB2 fails to validate kernel signature when booted directly without shim, allowing Secure Boot bypass on systems with imported kernel signing certificates.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

GRUB2 fails to validate kernel signature when booted directly without shim, allowing Secure Boot bypass on systems with imported kernel signing certificates.

Vulnerability

GRUB2 versions 2.04 and prior fail to validate the kernel signature when the bootloader is invoked directly without the shim intermediate. This occurs on systems where the kernel signing certificate has been imported directly into the UEFI Secure Boot database (db). The code path that performs signature verification is skipped, allowing any kernel—including unsigned or malicious ones—to be loaded and executed. [1][2]

Exploitation

An attacker must first gain the ability to modify the boot configuration or replace the kernel image on the target system. This can be achieved through physical access, remote root access, or by compromising a network boot (PXE) environment. Once the attacker places a malicious kernel (or modifies the GRUB configuration to load one), the system will boot it without signature verification because GRUB2 does not enforce the check when booted directly without shim. [1][4]

Impact

Successful exploitation bypasses UEFI Secure Boot protections, allowing the attacker to execute arbitrary code during the boot process. This can lead to persistent, stealthy bootkits that give near-total control over the victim device, including the ability to tamper with the operating system and evade detection. [1]

Mitigation

The vulnerability is inherent in GRUB2 2.04 and prior. The fix requires updating to a patched version of GRUB2 that correctly validates kernel signatures even when booted without shim. Operating system vendors have released updated grub2 packages; users should apply these updates and ensure that the bootloader is signed with a valid certificate. Additionally, vulnerable bootloader versions should be revoked from the Secure Boot database to prevent rollback attacks. [2][4]

References
  1. There's a Hole in the Boot
  2. SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass - Ubuntu Wiki
  3. Boot Hole Vulnerability - GRUB 2 boot loader - CVE-2020-10713 | Red Hat Customer Portal

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

31

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

20

News mentions

0

No linked articles in our index yet.