CVE-2015-8370

What it actually does

Integer underflows in grub_username_get and grub_password_get functions cause off-by-two and out-of-bounds memory overwrites when processing excessive backspace characters during authentication prompts.

Why it matters to the business

Attackers with physical access can bypass boot authentication to read or modify data, or corrupt storage on systems using vulnerable bootloaders, increasing risk of unauthorized access or system downtime.

How an attack unfolds

An attacker with physical proximity enters repeated backspace characters at the GRUB username or password prompt, triggering integer underflow that corrupts memory and allows bypassing authentication checks or inducing denial of service.

How to fix it

Update GRUB2 to a version beyond 2.02 that resolves the integer underflow conditions in auth.c and crypto.c; rebuild and reinstall bootloader images on affected systems.

How to confirm the fix worked

Confirm GRUB2 version is newer than 2.02 and test authentication prompts with backspace sequences to verify no memory corruption occurs; review bootloader build logs for patched sources.

Typical attack path

1. Gain physical access to the target system
2. Interrupt normal boot to reach GRUB authentication prompt
3. Input crafted sequence of backspace characters
4. Trigger memory corruption to bypass authentication or corrupt disk structures
5. Escalate to data access or denial of service

How to detect it

Review system boot logs and console history for anomalous authentication attempts or repeated backspace patterns; examine memory dumps or crash artifacts around boot time for signs of overwrite in GRUB modules.

What your security team should do

• Prioritize patching GRUB2 on all systems with physical access exposure
• Restrict physical access to servers and workstations using boot authentication
• Monitor for new GRUB2 releases and test in isolated environments before deployment
• Document bootloader versions across the fleet for future validation