Medium severity · published Nov 29, 2019
CVE-2019-14865
A flaw was found in the grub2-set-bootflag utility of grub2
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grub2 · Gnu
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14865
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14865
Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/02/06/3
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0335
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14865
Mailing List
https://seclists.org/oss-sec/2019/q4/101
More from Grub2
8.8
CVE-2024-56737
GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem
8.6
CVE-2022-2601
A buffer overflow was found in grub_font_construct_glyph()
8.2
CVE-2021-20233
A flaw was found in grub2 in versions prior to 2.06
8.2
CVE-2020-25632
A flaw was found in grub2 in versions prior to 2.06
8.2
CVE-2020-10713
A flaw was found in grub2, prior to version 2.06