Search for vulnerabilities
Vulnerability details: VCID-bxw1-p1gh-aaap
Vulnerability ID VCID-bxw1-p1gh-aaap
Aliases CVE-2020-27779
Summary A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-285 Improper Authorization
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-27779.html
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0696
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0697
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0698
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0699
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0700
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0701
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0702
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0703
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0704
rhas Moderate https://access.redhat.com/errata/RHSA-2021:1734
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2566
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2790
rhas Moderate https://access.redhat.com/errata/RHSA-2021:3675
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-27779.json
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2020-27779
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1900698
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14372
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25632
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27749
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27779
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20225
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20233
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 6.9 https://nvd.nist.gov/vuln/detail/CVE-2020-27779
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2020-27779
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2020-27779
archlinux Medium https://security.archlinux.org/AVG-1629
generic_textual Medium https://ubuntu.com/security/notices/USN-4992-1
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-27779.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-27779.json
https://api.first.org/data/v1/epss?cve=CVE-2020-27779
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14372
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25632
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25647
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27749
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27779
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20225
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20233
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/
https://security.gentoo.org/glsa/202104-05
https://security.netapp.com/advisory/ntap-20220325-0001/
https://ubuntu.com/security/notices/USN-4992-1
1900698 https://bugzilla.redhat.com/show_bug.cgi?id=1900698
ASA-202106-43 https://security.archlinux.org/ASA-202106-43
AVG-1629 https://security.archlinux.org/AVG-1629
cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:8.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_eus:8.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
CVE-2020-27779 https://nvd.nist.gov/vuln/detail/CVE-2020-27779
RHSA-2021:0696 https://access.redhat.com/errata/RHSA-2021:0696
RHSA-2021:0697 https://access.redhat.com/errata/RHSA-2021:0697
RHSA-2021:0698 https://access.redhat.com/errata/RHSA-2021:0698
RHSA-2021:0699 https://access.redhat.com/errata/RHSA-2021:0699
RHSA-2021:0700 https://access.redhat.com/errata/RHSA-2021:0700
RHSA-2021:0701 https://access.redhat.com/errata/RHSA-2021:0701
RHSA-2021:0702 https://access.redhat.com/errata/RHSA-2021:0702
RHSA-2021:0703 https://access.redhat.com/errata/RHSA-2021:0703
RHSA-2021:0704 https://access.redhat.com/errata/RHSA-2021:0704
RHSA-2021:1734 https://access.redhat.com/errata/RHSA-2021:1734
RHSA-2021:2566 https://access.redhat.com/errata/RHSA-2021:2566
RHSA-2021:2790 https://access.redhat.com/errata/RHSA-2021:2790
RHSA-2021:3675 https://access.redhat.com/errata/RHSA-2021:3675
USN-4992-1 https://usn.ubuntu.com/4992-1/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-27779.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2020-27779
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-27779
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-27779
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.0405
EPSS Score 0.00025
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.