CVE-2021-20225 A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Found in grub2 Affecting Data Integrity and Availability Two vulnerabilities, CVE-2021-20225 and CVE-2021-20233, were discovered in grub2 versions prior to 2.06. CVE-2021-20225 allows attackers to write past the end of a heap, while CVE-2021-20233 enables memory corruption due to incorrect length calculations in menu rendering code. Both flaws pose risks to data confidentiality, integrity, and system availability. 2 sources 63