VULNERABILITY INTELLIGENCE
CVE-2015-8370
CVSS score7.4 HIGH
EPSS probability1.09%
CISA KEVNot currently listed
Published2015-12-16
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.
Weakness classification
- CWE-191: Integer Underflow (Wrap or Wraparound)