CVE-2020-14308: 
Alma Linux vulnerability analysis and mitigation

In grub2 versions before 2.06, a vulnerability was discovered where the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This vulnerability, identified as CVE-2020-14308, was disclosed on July 29, 2020, affecting GRUB2 bootloader systems. The issue impacts various operating systems and distributions that use GRUB2 as their bootloader (Ubuntu Security, Red Hat).

The vulnerability stems from the grub_malloc() function and related memory infrastructure not fully validating the allocation size. This leads to arithmetic overflows resulting in invalid memory allocations, which can be leveraged to cause heap-based buffer overflows in several code paths. The vulnerability has been assigned a CVSS 3.1 base score of 6.4 (Medium) with the vector: AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H (NVD, Red Hat Bugzilla).

The vulnerability can lead to invalid memory allocations which can be further used to cause possible integrity, confidentiality, and availability impacts during the boot process. When successfully exploited, this could allow an attacker to execute arbitrary code and potentially bypass UEFI Secure Boot restrictions (NetApp Security, Ubuntu USN).

To exploit this vulnerability, an attacker needs local privileged or physical access to the machine. The vulnerability requires a high level of privilege and high attack complexity to exploit, as indicated by its CVSS metrics. The issue has been confirmed to be exploitable in real-world scenarios (Red Hat Bugzilla, OSS Security).

The vulnerability was fixed in GRUB2 version 2.06. Vendors have released patches and updates to address this issue. Fully mitigating the vulnerability requires both an updated GRUB2 boot loader and the application of a UEFI Revocation List (dbx) to system firmware. Users are advised to update their systems to the latest version of GRUB2 and apply any vendor-specific patches (Gentoo Security, Ubuntu USN).