CVEvulnerability

CVE-2015-8370

7.4 HIGH Published 2015-12-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2015-12-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.4 HIGH — CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.9 MEDIUM — AV:L/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-191, CWE-264

Description

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.

Affected configurations

• gnu grub2 1.98 • gnu grub2 1.99 • gnu grub2 2.00 • gnu grub2 2.01 • gnu grub2 2.02 • fedoraproject fedora 23

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-191 Integer Underflow (Wrap or Wraparound) weakness

References