Strix
26.1K

CVE-2015-8370

HIGHCVSS 7.4/10EPSS 1.10%

Last modified

CVE-2015-8370 is a high-severity vulnerability rated 7.4/10 on the CVSS scale. Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.. EPSS estimates a 1.10% chance of exploitation in the next 30 days.

Description

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.

Metrics

CVSS 3.1
7.4/10

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
1.10%

61.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
GnuGrub21.98
GnuGrub21.99
GnuGrub22.00
GnuGrub22.01
GnuGrub22.02
FedoraprojectFedora23

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2015-8370?
Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.
How severe is CVE-2015-8370?
CVE-2015-8370 has a CVSS score of 7.4/10 (HIGH severity). The EPSS model estimates a 1.10% probability of exploitation in the next 30 days.
How do I fix CVE-2015-8370?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2015-8370?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST