vulnerability
Oracle Linux: CVE-2021-3697: ELSA-2022-9595: grub2 security update (IMPORTANT) (Multiple Advisories)
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
6 | (AV:L/AC:H/Au:M/C:C/I:C/A:C) | Jun 7, 2022 | Jun 8, 2022 | Jan 7, 2025 |
Severity
6
CVSS
(AV:L/AC:H/Au:M/C:C/I:C/A:C)
Published
Jun 7, 2022
Added
Jun 8, 2022
Modified
Jan 7, 2025
Description
A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be performed the attacker needs to perform some triage over the heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.
A flaw was found in grub2 when handling JPEG images. This flaw allows an attacker to craft a malicious JPEG image, which leads to an underflow on a grub2's internal pointer, leading to a heap-based out-of-bounds write. Secure-boot mechanisms circumvention and arbitrary code execution may also be achievable.
A flaw was found in grub2 when handling JPEG images. This flaw allows an attacker to craft a malicious JPEG image, which leads to an underflow on a grub2's internal pointer, leading to a heap-based out-of-bounds write. Secure-boot mechanisms circumvention and arbitrary code execution may also be achievable.
Solution(s)
oracle-linux-upgrade-grub2oracle-linux-upgrade-grub2-commonoracle-linux-upgrade-grub2-efi-aa64oracle-linux-upgrade-grub2-efi-aa64-cdbootoracle-linux-upgrade-grub2-efi-aa64-modulesoracle-linux-upgrade-grub2-efi-ia32oracle-linux-upgrade-grub2-efi-ia32-cdbootoracle-linux-upgrade-grub2-efi-ia32-modulesoracle-linux-upgrade-grub2-efi-x64oracle-linux-upgrade-grub2-efi-x64-cdbootoracle-linux-upgrade-grub2-efi-x64-modulesoracle-linux-upgrade-grub2-pcoracle-linux-upgrade-grub2-pc-modulesoracle-linux-upgrade-grub2-toolsoracle-linux-upgrade-grub2-tools-efioracle-linux-upgrade-grub2-tools-extraoracle-linux-upgrade-grub2-tools-minimal

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.