ADVISORIES.md

BootHole advisories and additional resources

• Upstream Grub2 project
  • GRUB2 Git Repository
    • http://git.savannah.gnu.org/gitweb/?p=grub.git&view=view+git+repository
  • GRUB Developer Mailing List
    • https://lists.gnu.org/mailman/listinfo/grub-devel/
  • BootHole patch series
    • https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
• Microsoft
  • Security advisory
    • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011
  • Powershell script to help apply revocation list updates
    • https://aka.ms/DbxSplitScript
• UEFI Forum
  • Updated Revocation List
    • https://uefi.org/revocationlistfile
• Linux Distributions
  • Canonical
    • Security advisory
      • https://ubuntu.com/security/notices/USN-4432-1
    • KnowledgeBase article
      • https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass
  • Debian
    • Security advisory
      • https://www.debian.org/security/2020/dsa-4735
    • Additional information
      • https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot
  • Mageia
    • Bug tracking
      • https://bugs.mageia.org/show_bug.cgi?id=27018
  • Oracle
    • Security advisory
      • https://linux.oracle.com/errata/ELSA-2020-3220.html
  • Red Hat
    • Security advisory
      • https://access.redhat.com/security/cve/cve-2020-10713
    • Vulnerability response article
      • https://access.redhat.com/security/vulnerabilities/grub2bootloader
  • SUSE
    • Security advisory
      • https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/
    • Knowledge Base article
      • https://www.suse.com/support/kb/doc/?id=000019673
  • VMware
    • Knowledge Base article
      • https://kb.vmware.com/s/article/80181
• OEMs
  • Dell
    • High level overview
      • https://www.dell.com/support/article/en-us/sln322283
    • Additional information
      • https://www.dell.com/support/article/en-us/SLN322287
  • HP
    • HPSBHF03678 rev. 1 - GRUB2 Bootloader Arbitrary Code Execution
      • https://support.hp.com/us-en/document/c06707446
  • HPE
    • Security advisory
      • https://techhub.hpe.com/eginfolib/securityalerts/Boot_Hole/boot_hole.html
  • Huawei
    • Security Notice
      • https://www.huawei.com/en/psirt/security-notices/2020/huawei-sn-20200730-01-grub2-en
  • Lenovo
    • Knowledge Base article
      • https://support.lenovo.com/fr/en/product_security/len-34794
• Networking Equipment
  • Cisco
    • Security advisory
      • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-grub2-code-exec-xLePCAPY
  • NetApp
    • Security advisory
      • https://security.netapp.com/advisory/ntap-20200731-0008/
• Vulnerability Coordination Centers and other notable organizations
  • CERT/CC
    • Vulnerability Note
      • https://kb.cert.org/vuls/id/174059
  • CERT-FR
    • Vulnerability Note (French)
      • https://www.cert.ssi.gouv.fr/avis/CERTFR-2020-AVI-477/
  • JPCERT/CC
    • Vulnerability Note (Japanese)
      • http://jvn.jp/vu/JVNVU98487886/index.html
  • NSA
    • Press Article
      • https://www.nsa.gov/news-features/press-room/Article/2294715/nsa-releases-cybersecurity-advisory-on-grub2-boothole-vulnerability/
    • Cybersecurity Advisory
      • https://www.nsa.gov/Portals/70/documents/resources/cybersecurity-professionals/CSA_Mitigate_the_GRUB2_BootHole_Vulnerability_20200730_nsa_gov%20-%20Copy.pdf?ver=2020-07-30-170540-600

Please feel free to submit pull requests to add additional advisories as those are published