AZL-31036
Dashboard / Vulnerabilities / AZL-31036
Summary: CVE-2021-3697 affecting package grub2 for versions less than 2.06-12
Details: A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be performed the attacker needs to perform some triage over the heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.
References: https://nvd.nist.gov/vuln/detail/CVE-2021-3697
Affected packages
Package
Name: grub2
Purl: pkg:rpm/azure-linux/grub2
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -2.06-12
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
