title: GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim
description: GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.
problem types: CWE-347 Improper Verification of Cryptographic Signature
affected:
{
product: grub2 in Ubuntu
vendor: Ubuntu
versions:
lessThan: 2.04-1ubuntu26.1, status: affected, version: 20.04 LTS, versionType: custom
lessThan: 2.02-2ubuntu8.16, status: affected, version: 18.04 LTS, versionType: custom
lessThan: 2.02~beta2-36ubuntu3.26, status: affected, version: 16.04 LTS, versionType: custom
lessThan: 2.02~beta2-9ubuntu1.20, status: affected, version: 14.04 ESM, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]