Vulnerability · Published Mar 16, 2022 · Assigned by suse
CVE-2021-46705grub2-once uses fixed file name in /var/tmp
Medium 5.1
In plain English
A medium-severity security flaw in openSUSE Factory from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)5.1Medium
Exploit odds (30 days)0.2%top 84.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SUSE | SUSE Linux Enterprise Server 15 SP4 | grub2 – before 2.06-150400.7.1 |
| SUSE | openSUSE Factory | grub2 – before 2.06-18.1 |
Weakness: CWE-377 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
References
- https://bugzilla.suse.com/show_bug.cgi?id=1190474 x_refsource_CONFIRM