CVE-2021-3695

moderate-risk
Published 2022-07-06

A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform some triage over the heap layout to achieve signifcant results, also the values written into the memory are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2 versions prior grub-2.12.

Do I need to act?

-
0.06% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.5/10 Medium
LOCAL / HIGH complexity

Affected Products (20)

Developer Tools

Affected Vendors

Redhat Gnu Fedoraproject Netapp

References (6)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1991685
Third Party Advisory https://security.gentoo.org/glsa/202209-12
Third Party Advisory https://security.netapp.com/advisory/ntap-20220930-0001/
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1991685
Third Party Advisory https://security.gentoo.org/glsa/202209-12
Third Party Advisory https://security.netapp.com/advisory/ntap-20220930-0001/
35
/ 100
moderate-risk
Severity 12/34 · Low
Exploitability 0/34 · Minimal
Exposure 23/34 · High