SUSE-SU-2021:0679-1

    Dashboard / Vulnerabilities / SUSE-SU-2021:0679-1

    SUSE-SU-2021:0679-1

    Published: 2 Mar 2021Last Modified: 4 Feb 2026

    Summary: Security update for grub2

    Details: This update for grub2 fixes the following issues: grub2 now implements the new 'SBAT' method for SHIM based secure boot revocation. (bsc#1182057) Following security issues are fixed that can violate secure boot constraints: - CVE-2020-25632: Fixed a use-after-free in rmmod command (bsc#1176711) - CVE-2020-25647: Fixed an out-of-bound write in grub_usb_device_initialize() (bsc#1177883) - CVE-2020-27749: Fixed a stack buffer overflow in grub_parser_split_cmdline (bsc#1179264) - CVE-2020-27779, CVE-2020-14372: Disallow cutmem and acpi commands in secure boot mode (bsc#1179265 bsc#1175970) - CVE-2021-20225: Fixed a heap out-of-bounds write in short form option parser (bsc#1182262) - CVE-2021-20233: Fixed a heap out-of-bound write due to mis-calculation of space required for quoting (bsc#1182263) grub2 was bumped to version 2.02, same as SUSE Linux Enterprise 12 SP3.

    References: https://www.suse.com/support/update/announcement/2021/suse-su-20210679-1/, https://bugzilla.suse.com/1175970, https://bugzilla.suse.com/1176711, https://bugzilla.suse.com/1177883, https://bugzilla.suse.com/1179264, https://bugzilla.suse.com/1179265, https://bugzilla.suse.com/1182057, https://bugzilla.suse.com/1182262, https://bugzilla.suse.com/1182263, https://www.suse.com/security/cve/CVE-2020-14372, https://www.suse.com/security/cve/CVE-2020-25632, https://www.suse.com/security/cve/CVE-2020-25647, https://www.suse.com/security/cve/CVE-2020-27749, https://www.suse.com/security/cve/CVE-2020-27779, https://www.suse.com/security/cve/CVE-2021-20225, https://www.suse.com/security/cve/CVE-2021-20233

    Affected packages

    Package

    Name: grub2

    Purl: pkg:rpm/suse/grub2&distro=SUSE%20OpenStack%20Cloud%207

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.02-115.59.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2021:0679-1 | CVE-DB