The version of grub2 installed on the remote host is prior to 2.06-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1684 advisory.

    2024-02-29: CVE-2019-14865 was added to this advisory.

    A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under     resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and     leaving the system unbootable on subsequent reboots. (CVE-2019-14865)

    A flaw was found in GRUB 2, where it incorrectly enables the usage of the ACPI command when Secure Boot is     enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table     (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The     table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the     attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and     integrity, as well as system availability. (CVE-2020-14372)

    A flaw was found in grub2. The rmmod implementation allows the unloading of a module used as a dependency     without checking if any other dependent module is still loaded leading to a use-after-free scenario. This     could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from     this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25632)

    A flaw was found in grub2. During USB device initialization, descriptors are read with very little bounds     checking and assumes the USB device is providing sane values. If properly exploited, an attacker could     trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot     mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2020-25647)

    A flaw was found in grub2. Variable names present are expanded in the supplied command line into their     corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds     checking. If the function is called with a command line that references a variable with a sufficiently     large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution     which could also circumvent Secure Boot protections. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-27749)

    A flaw was found in grub2. The cutmem command does not honor secure boot locking allowing an privileged     attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections     after proper triage about grub's memory layout. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-27779)

    A flaw was found in grub2. The option parser allows an attacker to write past the end of a heap-allocated     buffer by calling certain commands with a large number of specific short forms of options. The highest     threat from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2021-20225)

    A flaw was found in grub2. Setparam_prefix() in the menu rendering code performs a length calculation on     the assumption that expressing a quoted single quote will require 3 characters, while it actually requires     4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The     highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2021-20233)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : grub2 (ALAS-2021-1684)

high Nessus Plugin ID 151799

Version 1.6

Version 1.5

Version 1.4

Version 1.4

Version 1.3

Version 1.6 Dec 12, 2024, 9:55 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202412120955
Version 1.5 Mar 5, 2024, 5:50 PM Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202403051750
Version 1.4 Mar 5, 2024, 7:01 AM CVE (set "CVE" coverage to "CVE-2019-14865,CVE-2020-14372,CVE-2020-25632,CVE-2020-25647,CVE-2020-27749,CVE-2020-27779,CVE-2021-20225,CVE-2021-20233") Detection (updated detection logic) Exploit attributes ("Exploitability ease" changed from "Exploits are available" to "No known exploits are available") Plugin metadata Plugin Feed: 202403050701
Version 1.4 Mar 5, 2024, 2:40 PM Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202403051440
Version 1.3 Dec 7, 2023, 3:25 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202312071525