Every CVE Search/ Get API key

CVE-2015-5281

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI...

2.6 LowFix available

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.

Exploit likelihood

0.34%Down 0.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 2.6

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.

Record
CVE-2015-5281
CVSS 2.0
2.6 LowAV:L/AC:H/Au:N/C:P/I:P/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.

Record
CVE-2015-5281
Updated
2026-11-02
EUVDEUVD-2015-5260 No score

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.

Record
EUVD-2015-5260
Updated
2026-11-03
GitHub AdvisoriesGHSA-626f-gjf6-rgjr No score

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI...

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.

Record
GHSA-626f-gjf6-rgjr
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
grub2-debuginfo
Red Hat:enterprise_linux:7::client
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi-modules
Red Hat:enterprise_linux:7::client
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2
Red Hat:enterprise_linux:7::client
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi
Red Hat:enterprise_linux:7::client
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-tools
Red Hat:enterprise_linux:7::client
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi-modules
Red Hat:enterprise_linux:7::computenode
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2
Red Hat:enterprise_linux:7::computenode
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi
Red Hat:enterprise_linux:7::computenode
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-tools
Red Hat:enterprise_linux:7::computenode
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
Show 10 moreShow less
Affected packages
PackageAffectedFixed
grub2-debuginfo
Red Hat:enterprise_linux:7::server
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi-modules
Red Hat:enterprise_linux:7::server
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2
Red Hat:enterprise_linux:7::server
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi
Red Hat:enterprise_linux:7::server
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-tools
Red Hat:enterprise_linux:7::server
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi-modules
Red Hat:enterprise_linux:7::workstation
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2
Red Hat:enterprise_linux:7::workstation
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi
Red Hat:enterprise_linux:7::workstation
 before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-tools
Red Hat:enterprise_linux:7::workstation
 before 1:2.02-0.29.el7
1:2.02-0.29.el7

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-5281 is a low vulnerability (CVSS 2.6) in Redhat Enterprise Linux, published November 24, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in grub2-debuginfo 1:2.02-0.29.el7.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open