Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 427
Alerts This Week
Warning Icon 1 427

RedHat: RHSA-2021:2566-01 Moderate: fwupd Security Update

red hat
Calendar Grey June 29, 2021
Scroller Redhat
Canonical has released a critical update for snapd to address security flaws in Ubuntu 20.04. Update your system immediately!
An update for fwupd is now available for Red Hat Enterprise Linux 8

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

The fwupd packages provide a service that allows session software to update device firmware.
Security Fix(es):
* grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled (CVE-2020-14372)
* grub2: Use-after-free in rmmod command (CVE-2020-25632)
* grub2: Out-of-bounds write in grub_usb_device_initialize() (CVE-2020-25647)
* grub2: Stack buffer overflow in grub_parser_split_cmdline() (CVE-2020-27749)
* grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled (CVE-2020-27779)
* grub2: Heap out-of-bounds write in short form option parser (CVE-2021-20225)
* grub2: Heap out-of-bounds write due to miscalculation of space required for quoting (CVE-2021-20233)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat moderate threat system update security impact Linux Enterprise fwupd

References

https://access.redhat.com/security/cve/CVE-2020-14372 https://access.redhat.com/security/cve/CVE-2020-25632 https://access.redhat.com/security/cve/CVE-2020-25647 https://access.redhat.com/security/cve/CVE-2020-27749 https://access.redhat.com/security/cve/CVE-2020-27779 https://access.redhat.com/security/cve/CVE-2021-20225 https://access.redhat.com/security/cve/CVE-2021-20233 https://access.redhat.com/security/updates/classification#moderate https://access.redhat.com/security/vulnerabilities/RHSB-2021-003

Package List

Red Hat Enterprise Linux BaseOS (v. 8):
Source: fwupd-1.5.9-1.el8_4.src.rpm
aarch64: fwupd-1.5.9-1.el8_4.aarch64.rpm fwupd-debuginfo-1.5.9-1.el8_4.aarch64.rpm fwupd-debugsource-1.5.9-1.el8_4.aarch64.rpm fwupd-tests-debuginfo-1.5.9-1.el8_4.aarch64.rpm
ppc64le: fwupd-1.5.9-1.el8_4.ppc64le.rpm fwupd-debuginfo-1.5.9-1.el8_4.ppc64le.rpm fwupd-debugsource-1.5.9-1.el8_4.ppc64le.rpm
s390x: fwupd-1.5.9-1.el8_4.s390x.rpm fwupd-debuginfo-1.5.9-1.el8_4.s390x.rpm fwupd-debugsource-1.5.9-1.el8_4.s390x.rpm fwupd-tests-debuginfo-1.5.9-1.el8_4.s390x.rpm
x86_64: fwupd-1.5.9-1.el8_4.x86_64.rpm fwupd-debuginfo-1.5.9-1.el8_4.x86_64.rpm fwupd-debugsource-1.5.9-1.el8_4.x86_64.rpm fwupd-tests-debuginfo-1.5.9-1.el8_4.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key


Advisory ID: RHSA-2021:2566-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:2566
Issue date: 2021-06-29

Topic

An update for fwupd is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat moderate threat system update security impact Linux Enterprise fwupd

Relevant Releases Architectures

Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

1873150 - CVE-2020-14372 grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled

1879577 - CVE-2020-25632 grub2: Use-after-free in rmmod command

1886936 - CVE-2020-25647 grub2: Out-of-bounds write in grub_usb_device_initialize()

1899966 - CVE-2020-27749 grub2: Stack buffer overflow in grub_parser_split_cmdline()

1900698 - CVE-2020-27779 grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled

1924696 - CVE-2021-20225 grub2: Heap out-of-bounds write in short form option parser

1926263 - CVE-2021-20233 grub2: Heap out-of-bounds write due to miscalculation of space required for quoting

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.