Security Advisory - Buffer Overflow Vulnerability BootHole in GRUB2 Secure Boot

Eclypsium researchers have discovered a vulnerability named“BootHole”in the GRUB2 bootloader. There is a buffer overflow vulnerability that can be used to gain arbitrary code execution during the boot process, even when Secure Boot is enabled. Attackers exploiting this vulnerability can install persistent and stealthy bootkits or malicious bootloaders that could give them near-total control over the victim device. (Vulnerability ID: HWPSIRT-2020-14407) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-10713.

Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200923-01-grub2-en