Search for vulnerabilities
Vulnerability details: VCID-snv7-6wk5-aaab
Vulnerability ID VCID-snv7-6wk5-aaab
Aliases CVE-2021-20225
Summary A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-787 Out-of-bounds Write
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2021/CVE-2021-20225.html
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0696
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0697
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0698
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0699
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0700
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0701
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0702
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0703
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0704
rhas Moderate https://access.redhat.com/errata/RHSA-2021:1734
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2566
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2790
rhas Moderate https://access.redhat.com/errata/RHSA-2021:3675
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20225.json
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
epss 0.00225 https://api.first.org/data/v1/epss?cve=CVE-2021-20225
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1924696
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14372
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25632
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27749
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27779
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20225
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20233
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 7.2 https://nvd.nist.gov/vuln/detail/CVE-2021-20225
cvssv3 6.7 https://nvd.nist.gov/vuln/detail/CVE-2021-20225
cvssv3.1 6.7 https://nvd.nist.gov/vuln/detail/CVE-2021-20225
archlinux Medium https://security.archlinux.org/AVG-1629
generic_textual Medium https://ubuntu.com/security/notices/USN-4992-1
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2021/CVE-2021-20225.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20225.json
https://api.first.org/data/v1/epss?cve=CVE-2021-20225
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14372
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25632
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25647
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27749
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27779
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20225
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20233
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/
https://security.gentoo.org/glsa/202104-05
https://security.netapp.com/advisory/ntap-20220325-0001/
https://ubuntu.com/security/notices/USN-4992-1
1924696 https://bugzilla.redhat.com/show_bug.cgi?id=1924696
ASA-202106-43 https://security.archlinux.org/ASA-202106-43
AVG-1629 https://security.archlinux.org/AVG-1629
cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:8.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_eus:8.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
CVE-2021-20225 https://nvd.nist.gov/vuln/detail/CVE-2021-20225
RHSA-2021:0696 https://access.redhat.com/errata/RHSA-2021:0696
RHSA-2021:0697 https://access.redhat.com/errata/RHSA-2021:0697
RHSA-2021:0698 https://access.redhat.com/errata/RHSA-2021:0698
RHSA-2021:0699 https://access.redhat.com/errata/RHSA-2021:0699
RHSA-2021:0700 https://access.redhat.com/errata/RHSA-2021:0700
RHSA-2021:0701 https://access.redhat.com/errata/RHSA-2021:0701
RHSA-2021:0702 https://access.redhat.com/errata/RHSA-2021:0702
RHSA-2021:0703 https://access.redhat.com/errata/RHSA-2021:0703
RHSA-2021:0704 https://access.redhat.com/errata/RHSA-2021:0704
RHSA-2021:1734 https://access.redhat.com/errata/RHSA-2021:1734
RHSA-2021:2566 https://access.redhat.com/errata/RHSA-2021:2566
RHSA-2021:2790 https://access.redhat.com/errata/RHSA-2021:2790
RHSA-2021:3675 https://access.redhat.com/errata/RHSA-2021:3675
USN-4992-1 https://usn.ubuntu.com/4992-1/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20225.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20225
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20225
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20225
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.05128
EPSS Score 0.00042
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.