high
7.5
CWE
787
Advisory Published
CVE Published
CVE Published
Updated

CVE-2021-3695

First published: Mon Aug 09 2021(Updated: )

A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform some triage over the heap layout to achieve signifcant results, also the values written into the memory are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2 versions prior grub-2.12.

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
debian/grub2
2.06-3~deb10u1
2.06-3~deb10u3
2.06-3~deb11u5
2.06-3~deb11u4
2.06-13
2.12~rc1-9
redhat/grub2<1:2.02-123.el8_6.8
1:2.02-123.el8_6.8
redhat/grub2<1:2.02-87.el8_1.10
1:2.02-87.el8_1.10
redhat/grub2<1:2.02-87.el8_2.10
1:2.02-87.el8_2.10
redhat/grub2<1:2.02-99.el8_4.9
1:2.02-99.el8_4.9
redhat/grub2<1:2.06-27.el9_0.7
1:2.06-27.el9_0.7
redhat/grub<2.12
2.12
CentOS Grub2-pc-modules>=2.00<2.12
Red Hat Fedora=36
Red Hat Developer Tools=1.0
Red Hat OpenShift=3.0
Red Hat Enterprise Linux=8.0
Red Hat Enterprise Linux=8.1
Red Hat Enterprise Linux=8.4
Red Hat Enterprise Linux=9.0
Red Hat Enterprise Linux Server EUS=8.2
Red Hat Enterprise Linux Server EUS=8.4
Red Hat Enterprise Linux Server EUS=8.6
Red Hat Enterprise Linux Server EUS=9.0
Red Hat Enterprise Linux for Power, little endian=8.0
Red Hat Enterprise Linux for Power, little endian=9.0
Red Hat Enterprise Linux for Power, little endian - Extended Update Support=8.2
Red Hat Enterprise Linux for Power, little endian - Extended Update Support=8.4
Red Hat Enterprise Linux for Power, little endian - Extended Update Support=8.6
Red Hat Enterprise Linux for Power, little endian - Extended Update Support=9.0
Red Hat Enterprise Linux Server=8.2
Red Hat Enterprise Linux Server=8.4
Red Hat Enterprise Linux Server=8.6
Red Hat Enterprise Linux for SAP Applications for Power, little endian - Extended Update Support=8.1
Red Hat Enterprise Linux for SAP Applications for Power, little endian - Extended Update Support=8.2
Red Hat Enterprise Linux for SAP Applications for Power, little endian - Extended Update Support=8.4
Red Hat Enterprise Linux for SAP Applications for Power, little endian - Extended Update Support=8.6
Red Hat Enterprise Linux for SAP Applications for Power, little endian - Extended Update Support=9.0
Red Hat Enterprise Linux Server=8.2
Red Hat Enterprise Linux Server=8.4
Red Hat Enterprise Linux Server=8.6
Red Hat OpenShift Container Platform=4.6
Red Hat OpenShift Container Platform=4.9
Red Hat OpenShift Container Platform=4.10
Red Hat Enterprise Linux=8.0
Red Hat CodeReady Linux Builder
Red Hat Enterprise Linux=9.0
Red Hat Enterprise Linux Server EUS=8.2
Red Hat Enterprise Linux Server EUS=8.4
Red Hat Enterprise Linux Server EUS=8.6
Red Hat Enterprise Linux Server EUS=9.0
NetApp ONTAP Select Deploy

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is CVE-2021-3695?

    CVE-2021-3695 is a vulnerability in grub 2 that may lead to heap data corruption or arbitrary code execution.

  • How severe is CVE-2021-3695?

    CVE-2021-3695 has a severity rating of 7 (high).

  • What is the affected software?

    The affected software includes Redhat Enterprise Linux versions 8.0 to 8.6, Redhat Codeready Linux Builder, and Netapp Ontap Select Deploy Administration Utility.

  • How can CVE-2021-3695 be exploited?

    CVE-2021-3695 can be exploited through a crafted 16-bit grayscale PNG image that triggers an out-of-bounds write in the heap area.

  • Where can I find more information about CVE-2021-3695?

    You can find more information about CVE-2021-3695 on the CVE website, NIST National Vulnerability Database, Redhat Bugzilla, and Redhat Access Portal.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203