CVE-2020-14311

—

CVSS 3.1

6.0 medium

EPSS

<1%p39

Published

Jul 31, 2020 (Jul 31, 2020)

Modified

Jun 17, 2026

Description

There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow.

Vendors: gnu redhat opensuse canonical
Products: grub2, enterprise linux, enterprise linux eus, enterprise linux server aus, enterprise linux server tus, leap, ubuntu linux
Weakness: CWE-122, CWE-190
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.