Vulnerability record · CVE-2020-14372 · published 3 March 2021
CVE-2020-14372: Gnu grub2 vulnerability
Gnu · Grub2
A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability.
Description
A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
9 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://access.redhat.com/security/vulnerabilities/RHSB-2021-003 | PatchThird Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=1873150 | Issue TrackingThird Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH | |
| https://security.gentoo.org/glsa/202104-05 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20210416-0004/ | Third Party Advisory |
| https://access.redhat.com/security/vulnerabilities/RHSB-2021-003 | PatchThird Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=1873150 | Issue TrackingThird Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH | |
| https://security.gentoo.org/glsa/202104-05 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20210416-0004/ | Third Party Advisory |
Track CVE-2020-14372 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-14372), CISA KEV, FIRST EPSS (scores of 2026-11-14). This page is refreshed as NVD updates the record.
