PT-2021-5815 · Grub2+10 · Grub2+10
Marco Benatto
·
Published
2021-02-08
·
Updated
2026-02-26
·
CVE-2021-20233
CVSS v3.1
8.2
High
| Vector | AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
grub2 versions prior to 2.06
Description
A flaw was found in the menu rendering code of grub2, specifically in the
Setparam prefix() function, which performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters. This allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this issue is to data confidentiality and integrity as well as system availability. Exploitation of the flaw may allow an attacker to access confidential data, compromise data integrity, and cause a denial of service.Recommendations
For versions prior to 2.06, update to version 2.06 or later to resolve the issue. As a temporary workaround, consider restricting access to the
Setparam prefix() function in the menu rendering code until a patch is available.Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Grub2