A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1926263 | Issue Tracking Patch Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/ | Mailing List Third Party Advisory |
| https://security.gentoo.org/glsa/202104-05 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20220325-0001/ | Third Party Advisory |
Advertisement
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Information
Published : 2021-03-03 09:15
Updated : 2022-04-18 12:27
NVD link : CVE-2021-20233
Mitre link : CVE-2021-20233
JSON object : View
CWE
CWE-787
Out-of-bounds Write
Advertisement
Products Affected
redhat
- enterprise_linux_server_aus
- enterprise_linux
- enterprise_linux_workstation
- enterprise_linux_server_tus
- enterprise_linux_server_eus
fedoraproject
- fedora
gnu
- grub2
netapp
- ontap_select_deploy_administration_utility