Currently grub_malloc() function and related memory infrastructure underlying it doesn't fully validate the allocation size. This can lead to arithmetic overflows leading to invalid memory allocations, which can be leverage to heap-based overflows in several code paths.
In the current grub versions, grub_malloc() malloc function doesn't validate if the allocation size may overflow the maximum type representation. This leads grub_malloc() to return invalid allocations, an attacker may leverage causing memory corruption leading to possible integrity, confidentiality and availability impacts. To be able to exploit this the attacker needs local privileged or physical access to the machine.
Acknowledgments: Name: Chris Coulson (Ubuntu Security Team)
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:3216 https://access.redhat.com/errata/RHSA-2020:3216
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-14308
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:3217 https://access.redhat.com/errata/RHSA-2020:3217
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:3223 https://access.redhat.com/errata/RHSA-2020:3223
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:3227 https://access.redhat.com/errata/RHSA-2020:3227
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.2 Advanced Update Support Via RHSA-2020:3273 https://access.redhat.com/errata/RHSA-2020:3273
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.4 Advanced Update Support Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions Red Hat Enterprise Linux 7.4 Telco Extended Update Support Via RHSA-2020:3275 https://access.redhat.com/errata/RHSA-2020:3275
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.6 Extended Update Support Via RHSA-2020:3271 https://access.redhat.com/errata/RHSA-2020:3271
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.3 Advanced Update Support Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions Red Hat Enterprise Linux 7.3 Telco Extended Update Support Via RHSA-2020:3276 https://access.redhat.com/errata/RHSA-2020:3276
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Extended Update Support Via RHSA-2020:3274 https://access.redhat.com/errata/RHSA-2020:3274
Created grub2 tracking bugs for this issue: Affects: fedora-all [bug 1863017]