VULNERABILITY INTELLIGENCE
CVE-2020-15705
CVSS score6.4 MEDIUM
EPSS probability1.39%
CISA KEVNot currently listed
Published2020-07-29
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.
Weakness classification
- security@ubuntu.com: CWE-347
- nvd@nist.gov: CWE-347
Primary references
- security@ubuntu.com — Mailing List, Third Party Advisory
- security@ubuntu.com — Mailing List, Third Party Advisory
- security@ubuntu.com — Third Party Advisory
- security@ubuntu.com — Mailing List, Third Party Advisory
- security@ubuntu.com — Mailing List, Third Party Advisory
- security@ubuntu.com — Mailing List, Third Party Advisory
- security@ubuntu.com — Mailing List, Third Party Advisory
- security@ubuntu.com — Mailing List, Third Party Advisory
- security@ubuntu.com — Third Party Advisory
- security@ubuntu.com — Issue Tracking, Vendor Advisory
- security@ubuntu.com — Patch, Third Party Advisory, Vendor Advisory
- security@ubuntu.com — Third Party Advisory