Read the docs
TI-2021-02632 Aliases CVE-2021-3697GHSA-pr45-j47f-755r

Out-of-bounds write in grub2

Priority LOW 31CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be performed the attacker needs to perform some triage over the heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.

Why it matters now

EPSS 0.00469 40th percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—grub2grub-2.06—No fix listedCNA
  • grub2 Vendor— Affected grub-2.06 Fixed in — No fix listed CNA

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*2.00 to before 2.12VulnerableGNU
cpe:2.3:a:redhat:developer_tools:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.1:*:*:*:*:*:*:*8.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*8.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
  • cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* Versions 2.00 to before 2.12 Vulnerable ·GNU
  • cpe:2.3:a:redhat:developer_tools:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:*8.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*8.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*8.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*8.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*8.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.6:*:*:*:*:*:*:*4.6VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:*4.9VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*4.10VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:a:redhat:codeready_linux_builder:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*8.2Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*8.4Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*8.6Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:*9.0Running onRed Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* Versions 8.2 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* Versions 8.4 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* Versions 8.6 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat

Remediation

Red Hat 5 advisories

  • RHSA-2022:5100 Released 2022-06-16 · Red Hat rating Important
    grub2, mokutil, shim, and shim-unsigned-x64 security update
    • Red Hat CodeReady Linux Builder EUS (v. 8.2) shim-unsigned-x64-15.6-1.el8
    • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) grub2-1:2.02-87.el8_2.10, grub2-common-1:2.02-87.el8_2.10, grub2-efi-aa64-1:2.02-87.el8_2.10 +20
  • RHSA-2022:5095 Released 2022-06-16 · Red Hat rating Important
    grub2, mokutil, shim, and shim-unsigned-x64 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) grub2-1:2.02-123.el8_6.8, grub2-common-1:2.02-123.el8_6.8, grub2-efi-aa64-1:2.02-123.el8_6.8 +20
    • Red Hat Enterprise Linux CRB (v. 8) shim-unsigned-x64-15.6-1.el8
  • RHSA-2022:5099 Released 2022-06-16 · Red Hat rating Important
    grub2, mokutil, shim, and shim-unsigned-x64 security update
    • Red Hat CodeReady Linux Builder (v. 9) shim-unsigned-x64-15.6-1.el9
    • Red Hat Enterprise Linux BaseOS (v. 9) grub2-1:2.06-27.el9_0.7, grub2-common-1:2.06-27.el9_0.7, grub2-efi-aa64-1:2.06-27.el9_0.7 +16
Show 2 more Red Hat advisories
  • RHSA-2022:5096 Released 2022-06-16 · Red Hat rating Important
    grub2, mokutil, shim, and shim-unsigned-x64 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.4) grub2-1:2.02-99.el8_4.9, grub2-common-1:2.02-99.el8_4.9, grub2-efi-aa64-1:2.02-99.el8_4.9 +20
    • Red Hat Enterprise Linux CRB EUS (v.8.4) shim-unsigned-x64-15.6-1.el8
  • RHSA-2022:5098 Released 2022-06-16 · Red Hat rating Important
    grub2, mokutil, and shim security update
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) grub2-1:2.02-87.el8_1.10, grub2-common-1:2.02-87.el8_1.10, grub2-efi-aa64-modules-1:2.02-87.el8_1.10 +17

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2022:5095
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2022:5099
Red Hat Enterprise Linux BaseOS E4S (v. 8.1)Fixed RHSA-2022:5098
Red Hat Enterprise Linux BaseOS EUS (v. 8.2)Fixed RHSA-2022:5100
Red Hat Enterprise Linux BaseOS EUS (v.8.4)Fixed RHSA-2022:5096
Not affected: 9 products
  • Red Hat CodeReady Linux Builder (v. 9)
  • Red Hat CodeReady Linux Builder EUS (v. 8.2)
  • Red Hat Enterprise Linux BaseOS (v. 8)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.1)
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2)
  • Red Hat Enterprise Linux BaseOS EUS (v.8.4)
  • Red Hat Enterprise Linux CRB (v. 8)
  • Red Hat Enterprise Linux CRB EUS (v.8.4)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3697
  2. 2026-10-03 Alias added: GHSA-pr45-j47f-755r

References

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences