Vulnerability Description
A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be performed the attacker needs to perform some triage over the heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Grub2 | >= 2.00, < 2.12 |
| Redhat | Developer Tools | 1.0 |
| Redhat | Openshift | 3.0 |
| Redhat | Enterprise Linux | 8.0 |
| Redhat | Enterprise Linux Eus | 8.2 |
| Redhat | Enterprise Linux For Power Little Endian | 8.0 |
| Redhat | Enterprise Linux For Power Little Endian Eus | 8.2 |
| Redhat | Enterprise Linux Server Aus | 8.2 |
| Redhat | Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions | 8.1 |
| Redhat | Enterprise Linux Server Tus | 8.2 |
| Redhat | Openshift Container Platform | 4.6 |
| Redhat | Codeready Linux Builder | - |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1991687Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202209-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220930-0001/Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1991687Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202209-12Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220930-0001/Third Party Advisory
FAQ
What is CVE-2021-3697?
CVE-2021-3697 is a vulnerability with a CVSS score of 7.0 (HIGH). A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be performed the attacker needs to perform some tri...
How severe is CVE-2021-3697?
CVE-2021-3697 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-3697?
Check the references section above for vendor advisories and patch information. Affected products include: Gnu Grub2, Redhat Developer Tools, Redhat Openshift, Redhat Enterprise Linux, Redhat Enterprise Linux Eus.