VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 29, 2020· Updated Sep 16, 2024

GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.

CVE-2020-15706

Description

GRUB2 2.04 and prior have a race condition in grub_script_function_create() leading to use-after-free, enabling arbitrary code execution and Secure Boot bypass.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

GRUB2 2.04 and prior have a race condition in grub_script_function_create() leading to use-after-free, enabling arbitrary code execution and Secure Boot bypass.

Vulnerability

GRUB2 versions 2.04 and earlier contain a race condition in the grub_script_function_create() function [4]. When a function is redefined while it is already executing, a use-after-free condition occurs. This vulnerability (CVE-2020-15706) affects all operating systems using GRUB2 with Secure Boot, including virtually every Linux distribution and Windows devices using the Microsoft Third Party UEFI CA [1].

Exploitation

An attacker must first establish access to the system, such as gaining physical access, modifying a PXE-boot network, or having remote root access on a networked system [3]. The attacker then triggers the race condition by redefining a GRUB2 function during its execution. This requires a crafted grub.cfg file or similar boot script manipulation. The race window allows a use-after-free to be exploited, leading to arbitrary code execution within the GRUB2 environment [4].

Impact

Successful exploitation yields arbitrary code execution during the boot process. The attacker can bypass UEFI Secure Boot, load unsigned boot modules, and install persistent bootkits or malicious bootloaders [1]. This gives near-total control over the victim device, with high impact on confidentiality, integrity, and availability (CVSS 6.4) [4].

Mitigation

Red Hat states there is no direct mitigation for the flaw [3]. The fix is to update GRUB2 packages to patched versions provided by Linux distributions. Eclypsium coordinated disclosure with OS vendors, and updates have been released by major distros such as Ubuntu [2]. Additionally, new signed bootloaders must be deployed and vulnerable bootloaders revoked to prevent rollback attacks [1].

References
  1. There's a Hole in the Boot
  2. SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass - Ubuntu Wiki
  3. Boot Hole Vulnerability - GRUB 2 boot loader - CVE-2020-10713 | Red Hat Customer Portal
  4. [SECURITY PATCH 00/28] Multiple GRUB2 vulnerabilities

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

31

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

17

News mentions

0

No linked articles in our index yet.