Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2021-3695

Published: 6 July 2022

A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform some triage over the heap layout to achieve signifcant results, also the values written into the memory are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2 versions prior grub-2.12.

Priority

Medium

Cvss 3 Severity Score

4.5

Score breakdown

Status

Package Release Status
grub2
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(does not affect Secure Boot)
focal Not vulnerable
(does not affect Secure Boot)
upstream Needs triage

impish Ignored
(end of life)
lunar Not vulnerable
(does not affect Secure Boot)
jammy Not vulnerable
(does not affect Secure Boot)
kinetic Not vulnerable
(does not affect Secure Boot)
mantic Not vulnerable
(does not affect Secure Boot)
xenial Not vulnerable
(does not affect Secure Boot)
grub2-unsigned
Launchpad, Ubuntu, Debian
upstream Needs triage

lunar Not vulnerable
(2.06-2ubuntu16)
xenial Needed

trusty Does not exist

bionic
Released (2.06-2ubuntu14.1)
kinetic Ignored
(end of life)
mantic Not vulnerable
(2.06-2ubuntu17)
focal
Released (2.06-2ubuntu14.1)
jammy
Released (2.06-2ubuntu14.1)
grub2-signed
Launchpad, Ubuntu, Debian
upstream Needs triage

lunar Not vulnerable
(1.192)
trusty Needed

xenial Needed

kinetic Ignored
(end of life)
mantic Not vulnerable
(1.193)
focal
Released (1.187.3~20.04.1)
jammy
Released (1.187.3~22.04.1)
bionic
Released (1.187.3~18.04.1)

Severity score breakdown

Parameter Value
Base score 4.5
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact Low
Availability impact Low
Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L