WaratekVRT Sign in

CVE-2020-14372 grub2

Affected softwaregrub2
Severity7.5 High CVSS 3.1 2 scores
WeaknessCWE-184
Published3 Mar 2021
Updated17 Jun 2026

Description

A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed, none at 5+ stars
  • EPSS 1.7% chance in 30 days

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Write-up and proof of concept exploit for CVE-2020-14372 4 2021-04-19

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H NVD Primary published
CVSS 2.0 6.2 none AV:L/AC:H/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Products and versions

9 products, 21 version entries
SourceVendorProductSchemeAffected versions
nvd fedoraproject fedora generic 33 · 34
nvd gnu grub2 generic ＜ 2.6
nvd netapp cloud backup generic any version
nvd netapp ontap select deploy administration utility generic any version
nvd redhat enterprise linux generic 7.0 · 8.0
nvd redhat enterprise linux server aus generic 7.2 · 7.3 · 7.4 · 7.6 · 7.7 · 8.2
nvd redhat enterprise linux server eus generic 7.6 · 7.7 · 8.1
nvd redhat enterprise linux server tus generic 7.4 · 7.6 · 7.7 · 8.2
nvd redhat enterprise linux workstation generic 7.0

References

URLTags
https://access.redhat.com/security/vulnerabilities/RHSB-2021-003 Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1873150 Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/
https://security.gentoo.org/glsa/202104-05 Third Party Advisory
https://security.netapp.com/advisory/ntap-20210416-0004/ Third Party Advisory

Timeline
Published2021-03-03By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.