Heap Underflow Vulnerability in GRUB2 by Red Hat

CVE-2021-3697

What is CVE-2021-3697?

A carefully crafted JPEG image can cause the JPEG reader in GRUB2 to underflow its data pointer, enabling an attacker to manipulate user-controlled data in the heap. Successful exploitation requires the attacker to meticulously analyze the heap layout and create a maliciously formatted image. This vulnerability could lead to data corruption and an opportunity for code execution or even bypassing secure boot mechanisms, particularly affecting versions of GRUB2 prior to 2.12.

References