Out-of-bounds Write Affecting grub2 package, versions <2.04-9.34.1
Snyk CVSS
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-SLES152-GRUB2-2687141
- published 14 Apr 2022
- disclosed 2 Mar 2021
Introduced: 2 Mar 2021
CVE-2021-20225 Open this link in a new tabHow to fix?
Upgrade SLES:15.2
grub2
to version 2.04-9.34.1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream grub2
package and not the grub2
package as distributed by SLES:15.2
.
See How to fix?
for SLES:15.2
relevant fixed versions and status.
A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
References
- CVE-2021-20225
- E-Mail link for SUSE-SU-2021:0683-1
- Link for SUSE-SU-2021:0683-1
- SUSE Bug 1175970
- SUSE Bug 1176711
- SUSE Bug 1177883
- SUSE Bug 1179264
- SUSE Bug 1179265
- SUSE Bug 1182057
- SUSE Bug 1182262
- SUSE Bug 1182263
- SUSE Bug 1192833
- SUSE CVE CVE-2020-14372 page
- SUSE CVE CVE-2020-25632 page
- SUSE CVE CVE-2020-25647 page
- SUSE CVE CVE-2020-27749 page
- SUSE CVE CVE-2020-27779 page
- SUSE CVE CVE-2021-20225 page
- SUSE CVE CVE-2021-20233 page
- SUSE Security Ratings
- secalert@redhat.com
- secalert@redhat.com
- secalert@redhat.com
- secalert@redhat.com